MalwarePublished 3 Jan 2026Updated 2 Feb 2026

LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan

Source AlienVault OTX General

Description

ESET researchers have uncovered a new China-aligned APT group named LongNosedGoblin targeting governmental entities in Southeast Asia and Japan for cyberespionage. The group employs a varied custom toolset of C#/.NET applications and abuses Group Policy for lateral movement. Key tools include NosyHistorian for collecting browser history, NosyDoor backdoor using cloud services as C&C, and NosyStealer for exfiltrating browser data. The attackers also utilize techniques like AppDomainManager injection and AMSI bypassing. LongNosedGoblin has been active since at least September 2023, showing ongoing campaigns throughout 2024 and 2025. The research provides detailed analysis of the group's malware and tactics, including potential sharing of the NosyDoor backdoor among multiple China-aligned actors.

Impact

For European organizations, the direct impact of LongNosedGoblin is currently limited due to its targeting focus on Southeast Asian and Japanese governmental entities. However, European governmental and diplomatic entities with interests or partnerships in these regions could be indirectly affected through intelligence leaks or supply chain compromises. The use of cloud services for C2 and abuse of Group Policy for lateral movement highlight risks to organizations with complex Windows domain environments and cloud integrations. If the group expands targeting or shares tools with other actors, European entities could face espionage risks involving sensitive political, economic, or strategic information. The compromise of browser data can lead to credential theft, session hijacking, and exposure of confidential communications, undermining confidentiality and trust. The advanced evasion techniques complicate detection and response, potentially allowing prolonged undetected access and data exfiltration. Overall, the threat underscores the need for vigilance in protecting governmental and critical infrastructure networks from sophisticated APT operations.

Defensive guidance

European organizations, especially governmental and diplomatic entities, should implement targeted defenses against LongNosedGoblin’s tactics. Specifically, restrict and monitor the use of Group Policy Objects (GPOs) to prevent unauthorized modifications that could facilitate lateral movement. Employ advanced endpoint detection and response (EDR) solutions capable of detecting AppDomainManager injection and AMSI bypass techniques. Monitor network traffic for unusual connections to cloud service domains and IP addresses linked to the threat actor’s infrastructure. Enforce strict browser security policies and limit the storage of sensitive data in browsers to reduce the impact of browser data theft. Conduct regular threat hunting exercises focusing on indicators of compromise such as the provided hashes, IPs, and domains. Implement multi-factor authentication (MFA) and least privilege principles to reduce the risk of credential theft and lateral movement. Maintain up-to-date threat intelligence feeds and share relevant findings with national cybersecurity centers and CERTs. Finally, conduct user awareness training to recognize spear-phishing or social engineering attempts that may serve as initial infection vectors.

Indicators of compromise

Domains 6

dev0-411506.iam.gserviceaccount.com
40dev0-411506.iam.gserviceaccount.com
www.privacypolicy-my.com
www.blazenewso.com
www.threadstub.com
www.sslvpnserver.com

IP addresses 5

101.99.88.113
101.99.88.188
118.107.234.26
118.107.234.29
38.54.17.131

Hashes 1

d53fcc01038e20193fbd51b7400075cf7c9c4402b73da7b0db836b000ebd8b1c

Community reviews

Loading reviews…