LongNosedGoblin

LongNosedGoblin is a previously undocumented China-aligned advanced persistent threat group focused on cyberespionage against government institutions in Southeast Asia and Japan. The group has been active since at least September 2023. ESET reported fewer than a dozen confirmed victims and assessed the actor as moderately sophisticated. The group is notable for abusing Windows Active Directory Group Policy to deploy malware and move laterally within compromised networks, which implies access to a Domain Controller and domain administrator credentials. Its toolset is primarily custom C#/.NET malware built for long-term surveillance and data theft. Reported malware and tooling include NosyHistorian, NosyDoor, NosyStealer, NosyDownloader, and NosyLogger, as well as a reverse SOCKS5 proxy, an argument runner used to launch applications including audio/video recording tools, and in some reporting a Cobalt Strike loader. NosyHistorian is used to inspect and collect browser history from Chrome, Edge, and Firefox to identify higher-value targets. Only a subset of victims then receive NosyDoor, a backdoor that gathers host metadata and supports file upload/download/delete, directory listing, shell command execution, and loading .NET assemblies. NosyDoor uses cloud services for command and control, especially Microsoft OneDrive; reporting also mentions Google Drive, and a variant using Yandex Disk was observed against an EU organization. NosyDoor employs AppDomainManager injection, and some LongNosedGoblin tools bypass AMSI. Some samples include execution guardrails restricting operation to specific victim machines. Additional tooling includes NosyStealer for browser data exfiltration, NosyDownloader for in-memory payload delivery, and NosyLogger, a modified DuckSharp-based keylogger. LongNosedGoblin has also used legitimate cloud services such as OneDrive and Google Drive for C2 and exfiltration, helping blend malicious traffic with normal enterprise activity. ESET noted similarities with ToddyCat and Erudite Mogwai but concluded LongNosedGoblin is distinct, particularly because of its specific use of Group Policy for malware deployment. ESET also assessed that NosyDoor is likely shared among multiple China-aligned threat actors. Cisco Talos separately assessed with high confidence that another China-nexus cluster, UAT-8302, shares tooling with LongNosedGoblin. Known aliases directly mentioned in the content are limited to LongNosedGoblin.