China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware

LongNosedGoblin uses Windows Group Policy to deploy malware across compromised networks and leverages cloud services like Microsoft OneDrive and Google Drive as command and control servers. The threat group employs a custom toolset consisting of C#/.NET applications including NosyHistorian for browser history collection, NosyDoor backdoor using OneDrive as C&C, NosyStealer for browser data exfiltration to Google Drive, NosyDownloader for payload deployment, and NosyLogger for keystroke logging based on DuckSharp. The group uses AppDomainManager injection and execution guardrails to limit operations to specific victim machines. Additional tools include reverse SOCKS5 proxy, video/audio recording utilities, and Cobalt Strike loader.