Breaking News — April 23, 2026
A previously undocumented state-backed threat actor named GopherWhisper has been discovered using a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord in attacks against government entities.
Key Findings
- Threat Actor: GopherWhisper (previously undocumented)
- Toolkit: Go-based custom malware
- Communication channels: Microsoft 365 Outlook, Slack, Discord
- Targets: Government entities
- Attribution: State-backed APT
Tactics
By abusing legitimate communication platforms, GopherWhisper blends in with normal traffic, making detection extremely difficult. The use of everyday business tools for command-and-control is a growing trend among sophisticated threat actors.
The Go-based toolkit suggests a well-resourced operation with custom development capabilities.
Source: BleepingComputer