Chinese APT ‘LongNosedGoblin’ Targeting Asian Governments

A newly identified Chinese APT, LongNosedGoblin, has been targeting government entities across Southeast Asia and Japan, according to ESET. The group has been active since at least September 2023 and is notable for using Group Policy to deploy its malware and move laterally within compromised networks. Its toolkit includes NosyHistorian, a C#/.NET application that collects browser data from Chrome, Firefox, and Edge, and NosyDoor, a backdoor that was observed using Microsoft OneDrive for C2.

LongNosedGoblin has also deployed NosyStealer, NosyDownloader, NosyLogger, a reverse SOCKS5 proxy, and an argument runner, with a fresh wave of attacks seen since September 2025. NosyDoor can collect metadata about infected systems and commands from C&C can prompt actions such as downloading or uploading files, deleting files, and executing shell commands. The group’s activities overlap with ToddyCat, and its tooling bears resemblance to Erudite Mogwai, though ESET notes definite differences in TTPs.