The China-linked LongNosedGoblin APT has been using Group Policy for malware deployment and lateral movement within governmental networks.

New China-aligned APT group is deploying Group Policy to sniff through government networks across Southeast Asia and Japan.

A new Chinese-backed advanced persistent threat (APT) group, which researchers have dubbed LongNosedGoblin, has been waging a cyber-espionage campaign against the governments of Japan and others across Southeast Asia since at least 2023.  The nosey ne'er-do-wells primarily use custom C#/.NET applications to conduct their operations, according to the ESET researchers who just published their research on the group. Most noteworthy, according to the report, was the APT group's use of Group Policy as a malware dropper, as well as a tool for lateral movement throughout the targeted networks. 

Dec 18, 2025Ravie LakshmananMalware / Cloud Security A previously undocumented China-aligned threat cluster dubbed LongNosedGoblin has been attributed to a series of cyber attacks targeting governmental entities in Southeast Asia and Japan. The end goal of these attacks is cyber espionage, Slovak cybersecurity company ESET said in a report published today. The threat activity cluster has been assessed to be active since at least September 2023.

The group, LongNosedGoblin, has been active since at least September 2023 and was uncovered after researchers detected new malware strains inside the network of a Southeast Asian government last year.

A previously undocumented China-aligned threat cluster dubbed LongNosedGoblin has been attributed to a series of cyber attacks targeting governmental entities in Southeast Asia and Japan. The end goal of these attacks is cyber espionage, Slovak cybersecurity company ESET said in a report published today. The threat activity cluster has been assessed to be active since at least September 2023. "

A China aligned threat group is using Windows Group Policy to deploy espionage malware, enabling stealthy compromise of targeted environments.

The group, LongNosedGoblin, has been active since at least September 2023 and was uncovered after researchers detected new malware strains inside the network of a Southeast Asian government last year.

Siber güvenlik uzmanları, devlet ağlarına sızmak için bulut servislerini ve sistem yönetim araçlarını kullanan LongNosedGoblin grubunu tespit etti. Japonya ve Güneydoğu Asya'da siber casusluk faaliyetleri yürüten grubun, geniş bir saldırı cephaneliği kullandığı ortaya çıktı.

<— Back Sniffing Around: Unmasking the LongNosedGoblin operation in Southeast Asia and Japan In this talk, we will present a detailed case study of a cyberespionage campaign that we uncovered targetin...

ESET researchers discovered a China-aligned APT group, LongNosedGoblin, which uses Group Policy to deploy cyberespionage tools across networks of governmental institutions.

Un nouveau groupe de pirates informatiques alignés sur la Chine, baptisé LongNosedGoblin, infiltre les gouvernements d'Asie du Sud-Est et du Japon. ESET dévoile qu'il détourne notamment les politiques...

New China-aligned APT group is deploying Group Policy to sniff through government networks across Southeast Asia and Japan.

The group, LongNosedGoblin, has been active since at least September 2023 and was uncovered after researchers detected new malware strains inside the network of a Southeast Asian government last year.

A new Chinese-backed advanced persistent threat (APT) group, which researchers have dubbed LongNosedGoblin, has been waging a cyber-espionage campaign against the governments of Japan and others across Southeast Asia since at least 2023.  The nosey ne'er-do-wells primarily use custom C#/.NET applications to conduct their operations, according to the ESET researchers who just published their research on the group. Most noteworthy, according to the report, was the APT group's use of Group Policy as a malware dropper, as well as a tool for lateral movement throughout the targeted networks. 

Dec 18, 2025Ravie LakshmananMalware / Cloud Security A previously undocumented China-aligned threat cluster dubbed LongNosedGoblin has been attributed to a series of cyber attacks targeting governmental entities in Southeast Asia and Japan. The end goal of these attacks is cyber espionage, Slovak cybersecurity company ESET said in a report published today. The threat activity cluster has been assessed to be active since at least September 2023.