China-Linked APT GopherWhisper Abuses Legitimate Services in Government Attacks
2026-04-27T07:24:07Z•afb4ba00803596a493d883c83a5f254ddfeee7c09412cc448bbfb8c933b80ecf
BitwardenChina-linked APTCisco firewallCopperhelmCrowdStrikeFast16FirestarterGo-based malwareGopherWhisperLocked ShieldsLogScaleNessusShai-HuludTeamPCPTenableagentic securityautonomous agentsbackdoorcyber exercisegovernment targetingnpm compromisepersistencesabotage malwaresupply chain attackvulnerability patches
What happened
Multiple high-impact incidents and trends were reported: a China-linked APT dubbed “GopherWhisper” is using Go-based backdoors, custom loaders/injectors and abusing legitimate services to target government organizations; a US federal agency’s Cisco firewall was compromised with a persistent “Firestarter” backdoor that survives patching and enables remote control; researchers linked a pre-Stuxnet sabotage malware named “Fast16” to attacks that tamper with high-precision calculation software and self-propagate. Separately, CrowdStrike and Tenable released patches (including a critical LogScale-f
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityweek
- Record identifier
- afb4ba00803596a493d883c83a5f254ddfeee7c09412cc448bbfb8c933b80ecf
- Enrichment time
- 2026-04-27T07:24:07Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.