LongNosedGoblinThreat actor
LongNosedGoblin is a China-aligned APT group targeting governmental entities in Southeast Asia and Japan for cyberespionage. The group employs Group Policy for malware deployment and utilizes cloud services like Microsoft OneDrive and Google Drive as C&C servers.From MISP Galaxy
Last reported 10 months ago, by ESET WeLiveSecurity1 report
Suspected originChinaMISP Galaxy
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1027.015Compression
“T1027.015”
- T1036Masquerading
“Masquerading: Match Legitimate Name or Location”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan“LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan”
Indicators in its reports
named in the reports above- hxxps://login.microsoftonline[.]com/common/oauth2/v2.0/tokenin 1 report
- dev0-411506.iam.gserviceaccount[.]comin 1 report
- hxxps://accounts.google[.]com/o/oauth2/authin 1 report
- hxxps://oauth2.googleapis[.]com/tokenin 1 report
- hxxps://www.googleapis[.]com/oauth2/v1/certsin 1 report
- hxxps://www.googleapis[.]com/robot/v1/metadata/x509/dev0-660%40dev0-411506.iam.gserviceaccount.comin 1 report
- d53fcc01038e2019…6b000ebd8b1cin 1 report
- 118.107.234[.]29in 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.