Mongolia

Mongolia continues to face a persistent cyber threat landscape, primarily from state-sponsored actors. A notable development from earlier in 2026 was the identification of GopherWhisper, a China-aligned threat actor, which targeted a Mongolian government entity. This group, active since at least November 2023, employed sophisticated tactics, including the use of legitimate communication platforms like Discord, Slack, and Microsoft 365 Outlook for command-and-control and data exfiltration, indicating a focus on cyber espionage. The National Security Council of Mongolia's Institute for Strategic Studies reported 1.6 million total cyberattacks and incidents in 2024, with 13,061 cybercrimes costing $25.4 million in damages.

In response, the Mongolian government has established a robust legal and regulatory framework, including a 2021 cybersecurity law and a National Cyber Security Strategy approved in January 2023. The Cyber Security Council confirmed in March 2026 that the legal environment is fully established with the approval of the National Cyber Attack Defense Plan and an Information Sharing and Cooperation Protocol. Mongolia has also shown progress in international rankings, ascending to Tier 3 (Evolving) in the Global Cybersecurity Index 2024, with its legal and organizational metrics surpassing the Asian regional average. However, challenges remain in translating this framework into practice, with compliance rates reported as critically low in 2025 and a need to strengthen audit quality and develop more skilled cybersecurity professionals.

Background: Threat actors known to target Mongolia include APT28 (Russia-linked), Earth Lusca (China-linked), APT21 (China-linked), Curious Gorge (China-linked), Gelsemium, and Vicious Panda (China-linked). Russian cyber spies, specifically APT29 (Midnight Blizzard), were also reported to have conducted espionage campaigns against Mongolia's Ministry of Foreign Affairs and Cabinet websites in 2023 and 2024.