LongNosedGoblin Threat Group Uses Windows Group Policy for Espionage Malware
- Securityish
- Threats & Incidents
Quick Summary
The LongNosedGoblin threat group, aligned with China, has been conducting cyber espionage attacks targeting government entities in Southeast Asia and Japan since at least September 2023. Utilizing Windows Group Policy, the group deploys malware such as NosyHistorian and NosyDoor through cloud services like Microsoft OneDrive. This activity raises significant concerns regarding cybersecurity and the potential for sensitive governmental data to be compromised.
The Securityish Brief
The LongNosedGoblin threat group has been linked to a series of cyber espionage attacks aimed at governmental organizations in Southeast Asia and Japan, with activity detected since September 2023. According to ESET, the group employs Windows Group Policy to distribute malware across compromised networks, using cloud services like Microsoft OneDrive and Google Drive for command and control operations.
The malware toolkit includes several custom tools, such as NosyHistorian, which collects browser history, and NosyDoor, a backdoor that allows file exfiltration and command execution. ESET first identified this group’s activity in February 2024, when it was found on a governmental system in Southeast Asia, highlighting the targeted nature of their operations.
While many victims were impacted by NosyHistorian, only a subset experienced NosyDoor infections, indicating a selective targeting strategy. The use of execution guardrails in the malware suggests that the attackers are focused on specific victims, enhancing the threat’s precision.
Additionally, the group has demonstrated versatility by adapting their tactics, techniques, and procedures (TTPs) across different attacks, including a variant of NosyDoor targeting an organization in an EU country. This adaptability raises concerns about the potential for malware sharing among various China-aligned threat actors.
Implications for Users and Organizations
The activities of LongNosedGoblin underscore the importance of robust cybersecurity measures for organizations, especially those in sensitive sectors like government. The use of Windows Group Policy for malware deployment highlights a potential vulnerability that organizations must address.
Everyday users should remain vigilant about the security of their devices and the software they use. Regularly updating software and monitoring for unusual activity can help mitigate risks associated with such sophisticated attacks.
Organizations should conduct thorough security assessments to identify potential weaknesses in their network configurations, particularly regarding the use of Group Policy. Implementing strict access controls and monitoring cloud service usage can further enhance security posture against similar threats.
Key Takeaways
- Regularly update all software to protect against vulnerabilities that could be exploited by malware.
- Monitor your network for unusual activity that may indicate a breach or malware presence.
- Review and tighten access controls on Group Policy settings to limit potential malware deployment.
- Educate employees about the risks of phishing and other social engineering tactics that may lead to malware infections.
- Consider conducting a cybersecurity assessment to identify and address vulnerabilities in your organization.
Key Terms & Concepts
- LongNosedGoblin: In this article, LongNosedGoblin refers to a China-aligned threat group involved in cyber espionage targeting governmental entities.
- NosyHistorian: NosyHistorian is a malware tool used by LongNosedGoblin to collect browser history from various web browsers.
- NosyDoor: NosyDoor is a backdoor malware that utilizes cloud services like Microsoft OneDrive for command and control operations.
- Group Policy: Group Policy is a Windows feature that allows administrators to manage settings and permissions across multiple computers in a network.
Read the original article here: https://thehackernews.com/2025/12/china-aligned-threat-group-uses-windows.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
