Something like this expression will get you started:
.{4}(?=.{3}$)
.{2}(?=.{6}$)
This matches any 4 (2) characters followed by the last 3 (6) characters. Depending on the language, you can replace based on dynamic lengths. In PHP:
$n = 3;
$m = 4;
$string = 'ABCDEFG12345678';
echo preg_replace('/.{' . $m . '}(?=.{' . $n . '}$)/', str_repeat('*', $m), $string);
// ABCDEFG1****678
More in depth RegExp explanation:
.{4} # matches any 4 characters
(?= # start a "lookahead"
.{3} # matches any 3 characters
$ # matches the end of the string
) # end the "lookahead"
This means that you will find whatever 4 characters are followed by 3 characters and the end of the string. Lookaheads aren't returned as a match, so you will still just be replacing those 4 characters matched.