LongNosedGoblin is a recently identified APT group aligned with China, active since at least September 2023, focusing on cyberespionage against governmental organizations in Southeast Asia and Japan. The group employs a sophisticated custom malware toolset primarily developed in C#/.NET, comprising NosyHistorian for harvesting browser histories, NosyDoor as a stealthy backdoor utilizing cloud services for command and control, and NosyStealer for exfiltrating sensitive browser data. Their operational tactics include abusing Windows Group Policy Objects (GPOs) to deploy malware and facilitate lateral movement across compromised networks, enabling broad internal access once initial footholds are established. They use advanced evasion techniques such as AMSI bypassing to evade antimalware detection and living-off-the-land methods that exploit legitimate Windows tools to minimize their footprint and avoid raising suspicion. The attack campaigns are multi-staged, indicating a well-planned and persistent approach to infiltrate, maintain access, and exfiltrate data from targeted networks. Indicators of compromise include specific malware hashes, IP addresses, and domains linked to their infrastructure, including cloud service domains used for command and control. While no public exploits are currently known, the group’s use of Group Policy for malware deployment and lateral movement presents a significant risk to organizations using Windows Active Directory environments. The threat actor’s focus on browser data collection and exfiltration suggests a goal of gathering intelligence on governmental affairs and sensitive communications. The medium severity rating reflects the complexity and targeted nature of the threat, requiring initial access but no publicly known exploits, and the potential for significant espionage impact.

For European organizations, especially governmental bodies and critical infrastructure entities, LongNosedGoblin represents a medium-level espionage threat. Although the group’s primary targets are in Southeast Asia and Japan, European entities with similar IT infrastructures—particularly those using Windows Active Directory and Group Policy—could be vulnerable to spillover or secondary targeting, especially if they have geopolitical ties or share intelligence with affected regions. The abuse of Group Policy for malware deployment can lead to rapid and widespread compromise within an organization’s network, enabling attackers to move laterally and harvest sensitive data such as browser histories, credentials, and other confidential information. The use of cloud services for command and control complicates detection and response, as traffic may blend with legitimate cloud communications. Successful intrusions could undermine the confidentiality and integrity of sensitive governmental communications, potentially impacting national security, diplomatic relations, and trust in digital infrastructure. The stealthy and persistent nature of the threat increases the difficulty of timely detection and eradication, raising the risk of prolonged espionage campaigns.

1. Implement continuous monitoring and auditing of Group Policy Objects (GPOs) to detect unauthorized or suspicious changes indicative of malware deployment. 2. Enforce strict network segmentation and apply least privilege access controls to limit lateral movement opportunities within internal networks. 3. Deploy advanced Endpoint Detection and Response (EDR) solutions capable of detecting AMSI bypass techniques and living-off-the-land tactics, focusing on anomalous usage of legitimate Windows tools and processes. 4. Monitor outbound network traffic for unusual connections to known malicious IP addresses and domains associated with LongNosedGoblin, including cloud service domains used for command and control. 5. Enforce multi-factor authentication (MFA) and maintain strong credential hygiene to reduce the risk of initial compromise. 6. Conduct regular threat hunting exercises focused on indicators of browser data exfiltration and stealthy backdoor persistence mechanisms. 7. Keep all operating systems, security tools, and endpoint software up to date to leverage the latest detection and mitigation capabilities against custom malware. 8. Provide targeted training for security teams to recognize signs of sophisticated APT activity, including multi-stage execution and stealthy persistence methods. 9. Establish information sharing and collaboration with national cybersecurity centers and international partners to exchange threat intelligence related to LongNosedGoblin indicators and tactics. 10. Consider deploying network detection tools that can analyze Group Policy changes and unusual cloud service interactions in real time.