China-Aligned APT Hackers Exploit Windows Group Policy to Deploy Malware

A China-aligned APT named LongNosedGoblin has conducted targeted cyberespionage against governmental entities in Southeast Asia and Japan since at least September 2023, using custom C#/.NET malware (NosyDoor, NosyHistorian) and abusing Windows Group Policy/Active Directory for stealthy lateral movement and broad payload distribution. The group employs a multi-stage infection chain with DES-encrypted payloads, AppDomainManager DLL injection to bypass AMSI, scheduled-task persistence via a renamed legitimate binary, and OneDrive-based C2 to maintain long-term access and harvest intelligence.