MoustachedBouncer· Belarus

MoustachedBouncer is a Belarus-linked nation-state cyberespionage group known for ISP-level AitM attacks and targeting foreign embassies.

Analyst brief

MoustachedBouncer is a Belarus-linked nation-state cyberespionage group active since at least 2014. The group primarily targets foreign embassies in Belarus, extending its operations to government sectors in Europe, Eastern Europe, South Asia, and Northeast Africa. Key TTPs include Adversary-in-the-Middle (AitM) attacks at the ISP level, initial access via Content Injection (T1659), execution with PowerShell/JavaScript, and the use of custom malware sets named NightClub, Disco, and SharpDisco. Defenders should focus on detecting anomalous network traffic (especially proxy-based C2), unauthorized PowerShell execution, and potential ISP-level traffic manipulation.

MoustachedBouncer

nation-state

MoustachedBouncer is a cyberespionage group discovered by ESET Research and first publicly disclosed in August 2023. The group has been active since at least 2014 and only targets foreign embassies in Belarus. Since 2020, MoustachedBouncer has most likely been able to perform adversary-in-the-middle (AitM) attacks at the ISP level, within Belarus, in order to compromise its targets. The group uses two separate toolsets that we have named NightClub and Disco.

origin (suspected)

Belarus· state-sponsoredattribution confidence: medium (50)

target countries (as stated by the source)

EuropeEastern EuropeSouth AsiaNortheast Africa

target sectors

Government

techniques · ATT&CK

Content Injection PowerShell JavaScript Exploitation for Privilege Escalation Software Packing Remote Data Staging Screen Capture Proxy

malware

NightClub Disco SharpDisco

source: misp-galaxy + mitre-attackG1019 2 refs →

Kill-chain playbook6

01
initial-access
T1659
Monitor web applications for suspicious content changes to detect Content Injection technique and restrict access.
02
execution
T1059.001 T1059.007
Monitor endpoint logs for suspicious PowerShell and JavaScript activity to detect execution and restrict execution policies.
03
privilege-escalation
T1068
Monitor system vulnerabilities and update software in a timely manner to detect exploitation for privilege escalation.
04
stealth
T1027.002
Monitor endpoints for suspicious processes and files to detect suspicious software packing.
05
collection
T1074.002 T1113
Monitor remote data staging and screen captures to detect suspicious data collection activity.
06
command-and-control
T1090
Monitor network traffic to detect suspicious proxy activity and restrict proxy usage.

FAQ2

Which country's foreign embassies does MoustachedBouncer target?

MoustachedBouncer only targets foreign embassies located in Belarus.

What type of attack has MoustachedBouncer been able to perform at the ISP level since 2020?

Since 2020, MoustachedBouncer has most likely been able to perform Adversary-in-the-Middle (AitM) attacks at the ISP level within Belarus.

MoustachedBouncer· Belarus

Analyst brief

MoustachedBouncer

Kill-chain playbook6

initial-access

execution

privilege-escalation

stealth

collection

command-and-control

FAQ2

See also5

MoustachedBouncer· Belarus

Analyst brief

MoustachedBouncer

Kill-chain playbook6

initial-access

execution

privilege-escalation

stealth

collection

command-and-control

FAQ2

See also5