LongNosedGoblin Caught Snooping on Asian Governments

A new Chinese-backed advanced persistent threat (APT) group, dubbed LongNosedGoblin, has been waging a cyber-espionage campaign against governments in Japan and across Southeast Asia since at least 2023. The group primarily uses custom C#/.NET applications and, notably, Group Policy as a malware dropper and for lateral movement within targeted networks, according to ESET researchers.

Group Policy’s legitimate use is to configure security policies in Windows environments, and experts warn that attackers with malware deployed via Group Policy can access Domain Controllers and domain administrator credentials. So far, LongNosedGoblin has claimed fewer than a dozen victims, and researchers describe its sophistication as moderate.

By December 2024, ESET noticed an updated version targeting the Japanese government, with bespoke tools such as NosyHistorian, NosyDoor, NosyStealer, NosyDownloader and NosyLogger, among others, plus a reverse SOCKS5 proxy and a video recorder component. According to ESET researchers, NosyDoor uses cloud services including Microsoft OneDrive for its command-and-control server. 19 December 2025.