Loading story…
A previously undocumented China-aligned advanced persistent threat group, identified as LongNosedGoblin, has been conducting cyber espionage campaigns targeting government institutions in Southeast Asia and Japan. The group leverages Windows Group Policy, a trusted administrative tool in Active Directory environments, to deploy custom malware and move laterally within compromised networks. This approach allows the attackers to distribute malicious payloads at scale and blend their activity with legitimate administrative traffic, making detection more challenging. The campaign has been active since at least September 2023, with renewed activity observed in 2024.
LongNosedGoblin's toolset includes several custom C#/.NET applications such as NosyHistorian for browser history collection, NosyDoor for backdoor access and file exfiltration, NosyStealer for browser data theft, NosyDownloader for in-memory payload delivery, and NosyLogger for keystroke logging. The group uses cloud services like Microsoft OneDrive and Google Drive as command and control infrastructure, further complicating detection by hiding malicious communications within normal enterprise traffic. The initial access vector remains unknown, but the focus on government targets and the use of sophisticated techniques indicate a long-term surveillance objective aligned with Chinese state interests.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On December 18, 2025, ESET publicly revealed the previously undocumented group LongNosedGoblin, describing its abuse of Windows Group Policy, cloud-based command and control, and malware suite including NosyHistorian, NosyDoor, NosyStealer, NosyDownloader, and NosyLogger. ESET also said NosyDoor may be shared or commercially available among multiple China-aligned actors.
ESET found evidence that the group remained active through 2024 and into 2025, with updated tools and renewed operations. This indicated sustained espionage activity rather than a short-lived campaign.
By December 2024, an updated version of NosyDownloader had been used against a Japanese government target. This showed continued refinement of the malware and expansion of operations against high-value government victims.
During 2024, LongNosedGoblin's NosyDownloader malware was observed broadly across Southeast Asian targets. The tool was used to deliver additional payloads as part of the group's espionage operations.
Researchers discovered the campaign in early 2024 while observing simultaneous compromises inside a Southeast Asian government network. The activity revealed the group's use of Windows Group Policy abuse for malware deployment and lateral movement.
ESET assessed that the China-aligned espionage group LongNosedGoblin has been active since at least September 2023, targeting government institutions in Southeast Asia and Japan. The group focused on long-term surveillance and data theft using custom C#/.NET malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcedarkreading.com
Open sourcehelpnetsecurity.com
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET disclosed a previously undocumented, China-aligned APT group dubbed **GopherWhisper** after uncovering an intrusion affecting about 12 systems at a Mongolian governmental institution, with command-and-control traffic indicating there may be dozens of additional victims. The campaign relied on a largely Go-based malware arsenal—including the **LaxGopher** backdoor, loaders, injectors, file collection and exfiltration tools, and a C++ backdoor called **SSLORDoor**—to maintain access and move data after compromise. The initial access vector remains unknown, but investigators first identified the activity in January 2025 on a Mongolian government system. The group concealed malicious communications inside trusted enterprise traffic by abusing **Slack**, **Discord**, **Microsoft 365 Outlook** draft messages via the Microsoft Graph API, direct encrypted traffic over port 443, and **file.io** for exfiltration and C2 support. ESET said recovered Slack and Discord API tokens, along with thousands of operator messages and Outlook drafts, exposed the attackers’ development workflow, testing environments, and operational mistakes. Metadata such as UTC+8 working hours and locale settings supported the assessment that the actor is China-aligned, while Outlook artifacts showed infrastructure timing including creation of the mailbox `barrantaya.1010@outlook[.]com` and compilation of the **FriendDelivery** DLL in July 2024.
Jun 29, 2026
A China-linked advanced persistent threat (APT) group infiltrated a U.S. non-profit organization focused on influencing U.S. government policy on international issues, maintaining access for several weeks in April 2025. The attackers initiated their campaign with mass scanning on April 5, targeting a server using multiple public exploits, including those for Log4j, Atlassian OGNL, Apache Struts, and GoAhead Web Server. After a brief pause, activity resumed on April 16 with connectivity tests and network reconnaissance, followed by the establishment of persistence through a scheduled task that executed `msbuild.exe` as SYSTEM every hour. This task likely injected code into `csc.exe`, which then communicated with a command-and-control server at `38.180.83[.]166`. The attackers also used DLL sideloading via the legitimate VipreAV component `vetysafe.exe` to load a malicious DLL (`sbamres.dll`), a technique previously associated with other Chinese APT groups. The intrusion demonstrated a focus on stealth and long-term access, with the use of legitimate binaries and scheduled tasks to evade detection. The attackers' tactics, including the use of `Imjpuexc` (a Microsoft file for East Asian input) to mask activity and the deployment of a custom loader to execute an encrypted payload (likely a remote access trojan) in memory, align with methods seen in other campaigns attributed to Chinese state-sponsored actors. The operation is part of a broader pattern of Chinese cyber-espionage targeting U.S. organizations involved in policy matters, leveraging both legacy and recent vulnerabilities to gain initial access and maintain persistence within high-value networks.
Jun 29, 2026
Palo Alto Networks Unit 42 reported a **previously undocumented Chinese threat actor**, tracked as **CL-UNK-1068**, conducting a multi-year intrusion campaign (observed since at least 2020) against high-value organizations across **South, Southeast, and East Asia**. Targeted sectors include **aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications**, with Unit 42 assessing **moderate-to-high confidence** that the primary objective is **cyber espionage** (while not fully ruling out criminal motives). The assessment cites tool provenance, linguistic artifacts in configurations, and consistent long-term targeting of Asian critical infrastructure as key factors supporting attribution. The activity features exploitation of **internet-facing web servers** to deploy **web shells** and establish persistence across both Windows and Linux environments, using a mix of custom malware, modified open-source tools, and **living-off-the-land binaries (LOLBINs)**. Reported tooling includes **Godzilla** and **ANTSWORD** web shells, the **Xnote** Linux backdoor, and **Fast Reverse Proxy (FRP)** for tunneling/relay; post-compromise behavior includes lateral movement and targeted file theft from Windows web servers (e.g., `c:\inetpub\wwwroot`) focusing on files such as `web.config`, `.aspx`, `.asmx`, `.asax`, and `.dll`, consistent with credential access and follow-on exploitation discovery.
Jun 29, 2026