Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · MoustachedBouncer · Nation-state · assessed origin Belarus · misp-galaxy + mitre-attack · refreshed 2026-10-06

MoustachedBouncer

state sponsor · BelarusMITRE G1019 ↗

MoustachedBouncer — ATT&CK roseMO

attack rose · 8 techniques across 6 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2021-1732

Analyst brief

misp-galaxy + mitre-attack

MoustachedBouncer is a cyberespionage group discovered by ESET Research and first publicly disclosed in August 2023. The group has been active since at least 2014 and only targets foreign embassies in Belarus. Since 2020, MoustachedBouncer has most likely been able to perform adversary-in-the-middle (AitM) attacks at the ISP level, within Belarus, in order to compromise its targets. The group uses two separate toolsets that we have named NightClub and Disco.

Observed targets (as stated by the sources)

0 countries · 1 sectors
Assessed origin: Belarus

assessed origin · Belarusobserved targets · 0

sectors · 1

  • Government

also stated: Europe, Eastern Europe, South Asia, Northeast Africa

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

8 techniques · 6 of 15 tactics

  1. Initial access

    1 technique

  2. Execution

    2 techniques

  3. Privilege escalation

    1 technique

  4. Stealth

    1 technique

  5. Collection

    2 techniques

  6. Command and control

    1 technique

select a technique

Arsenal

3 malware
Malware
Malware · 3ATT&CK
NightClubS1090 ↗
DiscoS1088 ↗
SharpDiscoS1089 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs MoustachedBouncer is cited as exploiting

none on KEV
  1. CVE-2021-17322026-10-17
    1. “MoustachedBouncer has exploited CVE-2021-1732 to execute malware components with elevated rights.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

2 sources
  1. 1.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-f…
  2. 2.attack.mitre.org/groups/G1019

Track MoustachedBouncer on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.