Analysis: China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware

Cyber Threat from LongNosedGoblin: Implications for North East India

A newly identified China-aligned threat group, LongNosedGoblin, has been targeting governmental entities in Southeast Asia and Japan since at least September 2023, with a focus on cyber espionage. This revelation, reported by Slovak cybersecurity company ESET, underscores the growing cybersecurity concerns in the Asian region, including the North East region of India.

Targeted Attacks and Tactics

LongNosedGoblin uses a custom toolset, primarily composed of C#/.NET applications, to infiltrate networks. The toolset includes NosyHistorian, which collects browser history, NosyDoor, a backdoor that uses cloud services for command and control, and NosyStealer, which exfiltrates browser data. The group also employs a reverse SOCKS5 proxy, a video recorder utility, and a Cobalt Strike loader.

Group Policy Exploitation

One of the unique tactics used by LongNosedGoblin is the exploitation of Group Policy, a Windows mechanism for managing settings and permissions. The group uses this tool to deploy malware across compromised networks.

Shared Trademarks and Potential Collaboration

While LongNosedGoblin shares some tradecraft with other threat clusters, such as ToddyCat and Erudite Mogwai, there is no definitive evidence linking them together. However, similarities between NosyDoor and LuckyStrike Agent, and the presence of the phrase "Paid Version" in the PDB path of LuckyStrike Agent, suggest that the malware may be sold or licensed to other threat actors.

Wider Reach and Implications

The discovery of another NosyDoor variant targeting an organization in an E.U. country, using Yandex Disk as a command and control server, suggests that the malware may be shared among multiple China-aligned threat groups. This raises concerns about the potential for these threats to spread beyond their initial targets.

Relevance to North East India and Broader Indian Context

Given the increasing digitalization and interconnectedness of governments and businesses, the North East region of India is not immune to such cyber threats. While there is no direct evidence of LongNosedGoblin targeting Indian entities, the broader implications for cybersecurity in the region cannot be ignored.

Looking Forward

As cyber threats continue to evolve, it is crucial for governments, businesses, and individuals to stay vigilant and adopt robust cybersecurity measures. This includes regular updates, strong passwords, and employee training to recognize and respond to potential threats. By doing so, we can collectively reduce the risk of falling victim to cyber attacks like those attributed to LongNosedGoblin.