China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware

A previously undocumented China-aligned threat cluster dubbed LongNosedGoblin has been attributed to a series of cyber attacks targeting governmental entities in Southeast Asia and Japan, with activity deemed to be for cyber espionage, according to ESET.

The group is said to be active since at least September 2023, and uses Windows Group Policy to deploy malware across compromised networks, while also employing cloud services such as Microsoft OneDrive and Google Drive as command and control servers, according to Microsoft.

Security researchers Anton Cherepanov and Peter Strýček noted that the threat toolkit is varied and mainly comprises NosyHistorian, NosyDoor, NosyStealer, NosyDownloader and NosyLogger, with NosyDoor delivering the backdoor and capable of exfiltrating files, deleting files and executing shell commands. ESET said it first detected activity in February 2024 on a governmental entity in Southeast Asia, and found that Group Policy was used to deliver the malware to multiple systems within the same organisation.

The researchers also observed that the NosyDoor dropper sometimes contains execution guardrails targeting specific victims, and that a Yandex Disk variant was used as a C&C in at least one instance, suggesting the malware may be shared among multiple China-aligned threat groups; they cautioned that there is only partial evidence linking LongNosedGoblin to other clusters such as ToddyCat and Erudite Mogwai.