LongNosedGoblin Caught Snooping on Asian Governments

Executive summary: ESET researchers identified a China-linked APT they call LongNosedGoblin that has targeted government organizations in Japan and Southeast Asia since at least 2023. The group uses custom C#/.NET tooling and notably abuses Active Directory Group Policy as a malware dropper and lateral-movement mechanism; its toolkit includes reconnaissance (NosyHistorian), backdoors (NosyDoor), data exfiltration and infostealers, downloaders, keyloggers, proxies, and capabilities to capture audio/video, with OneDrive used for C2.