NosyDoor
NosyDoor is a C#/.NET backdoor associated with China-aligned espionage activity, most notably operations attributed by ESET to the LongNosedGoblin cluster targeting government entities in Southeast Asia and Japan since at least 2023. It is typically deployed selectively after the NosyHistorian browser-history collection tool identifies victims of interest, and ESET observed that only a small subset of NosyHistorian-compromised systems received NosyDoor. The malware is notable for cloud-based command and control, using Microsoft OneDrive in observed LongNosedGoblin intrusions; a variant was also reported using Yandex Disk against an organization in an EU country. NosyDoor gathers host metadata including machine name, username, operating system version, and current process details, sends that information to its C2 service, and retrieves task files containing instructions. Reported capabilities include file exfiltration, file deletion, shell command execution, directory listing, and in some reporting the ability to load .NET assemblies. Multiple sources describe it as relying on living-off-the-land techniques, including AppDomainManager injection, and some associated tooling was reported to bypass AMSI. Specific technical details mentioned in the content include an internal name of "OneDrive" and the PDB path "E:\Csharp\Thomas\Server\ThomasOneDrive\obj\Release\OneDrive.pdb." Some NosyDoor samples included execution guardrails restricting operation to specific machines, indicating carefully selected targets. The content also states that NosyDoor is likely not exclusive to LongNosedGoblin and may be shared, commercially provided, or otherwise used by multiple China-aligned threat actors, complicating attribution. Related tooling observed in the same activity includes NosyHistorian, NosyStealer, NosyDownloader, NosyLogger, a reverse SOCKS5 proxy, and an argument runner used to launch audio/video capture tooling.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...it drops a backdoor called NosyDoor... NosyDoor utilizes cloud services including Microsoft OneDrive for its command-and-control server"
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Privilege Escalation
1 techniqueDefense Impairment
1 techniqueCommand and Control
1 technique“LongNosedGoblin… uses… Microsoft OneDrive and Google Drive as command and control (C&C) servers.”
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
This puts Showboat along with other shared frameworks like PlugX, ShadowPad, and NosyDoor that have been used by multiple China-nexus groups.
Shared frameworks such as PoisonIvy, ShadowPad, and more recently NosyDoor, have made attribution through this method increasingly difficult.
Backdoor used by LongNosedGoblin for persistent access and communication with infected endpoints, deployed via Group Policy abuse.
Backdoor deployed in LongNosedGoblin intrusions; selected for deployment based on reconnaissance (browser history) collected by NosyHistorian.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.