{
  "type": "bundle",
  "id": "bundle--bb0e3b25-fde5-5d27-aa26-d4706349bb74",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "name": "MoustachedBouncer",
      "aliases": [
        "MoustachedBouncer"
      ],
      "description": "MoustachedBouncer is a cyberespionage group discovered by ESET Research and first publicly disclosed in August 2023. The group has been active since at least 2014 and only targets foreign embassies in Belarus. Since 2020, MoustachedBouncer has most likely been able to perform adversary-in-the-middle (AitM) attacks at the ISP level, within Belarus, in order to compromise its targets. The group uses two separate toolsets that we have named NightClub and Disco.",
      "resource_level": "government",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G1019",
          "url": "https://attack.mitre.org/groups/G1019/"
        },
        {
          "source_name": "skopnix",
          "external_id": "moustachedbouncer",
          "url": "https://skopnix.com/actors/moustachedbouncer"
        },
        {
          "source_name": "welivesecurity.com",
          "url": "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G1019"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--96f1772e-5992-506b-bad6-7e87291acdde",
      "name": "Content Injection",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1659",
          "url": "https://attack.mitre.org/techniques/T1659/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16",
      "name": "PowerShell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.001",
          "url": "https://attack.mitre.org/techniques/T1059/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c",
      "name": "JavaScript",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.007",
          "url": "https://attack.mitre.org/techniques/T1059/007/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c",
      "name": "Exploitation for Privilege Escalation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1068",
          "url": "https://attack.mitre.org/techniques/T1068/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "privilege-escalation"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e",
      "name": "Software Packing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.002",
          "url": "https://attack.mitre.org/techniques/T1027/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--ff7b75a4-7ea8-5157-becc-86f891c5016a",
      "name": "Remote Data Staging",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1074.002",
          "url": "https://attack.mitre.org/techniques/T1074/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--17b2c547-e474-5675-ba71-5eea8131e971",
      "name": "Screen Capture",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1113",
          "url": "https://attack.mitre.org/techniques/T1113/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bd7954c9-4bdd-501a-ba9c-f186878ac084",
      "name": "Proxy",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1090",
          "url": "https://attack.mitre.org/techniques/T1090/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--d955e7d9-48e0-517c-8775-e70685f16874",
      "name": "NightClub",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1090",
          "url": "https://attack.mitre.org/software/S1090/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--2a087046-af7d-527f-89a2-1cc714d2bc8c",
      "name": "Disco",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1088",
          "url": "https://attack.mitre.org/software/S1088/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--ee83ce2f-4548-5d17-b499-91d9c400479d",
      "name": "SharpDisco",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1089",
          "url": "https://attack.mitre.org/software/S1089/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2201e9df-0d0b-5c02-a62a-eef43160543b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "attack-pattern--96f1772e-5992-506b-bad6-7e87291acdde"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--9bf9f29a-712e-57c9-ade9-f1f9554977eb",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--063b99c4-4123-5423-808e-a87904de706a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "attack-pattern--161497c1-55a4-5a1e-b82f-0967305ec89c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--eef4c207-e6bb-5311-9bed-f32ca5096b12",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f788b6f6-cc03-550e-abd5-612e90a7e5bb",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8d45d9b5-25d1-5eb2-a53b-fabbf70f6a77",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "attack-pattern--ff7b75a4-7ea8-5157-becc-86f891c5016a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fc30a6e3-fcc7-5d5e-bb37-2cfc493a205a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "attack-pattern--17b2c547-e474-5675-ba71-5eea8131e971"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1d2e4122-3e8a-5bc6-9a81-e9ae9c540511",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "attack-pattern--bd7954c9-4bdd-501a-ba9c-f186878ac084"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--cbcdf6d1-135f-5e09-8441-26192bdd3a17",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "malware--d955e7d9-48e0-517c-8775-e70685f16874"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f7f03d40-210a-56b9-b375-d047828508fd",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "malware--2a087046-af7d-527f-89a2-1cc714d2bc8c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6445fbef-d4ed-5dd8-84f6-2707b44b307c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--327b4f54-40fb-55fa-83a9-27497afed9c4",
      "target_ref": "malware--ee83ce2f-4548-5d17-b499-91d9c400479d"
    }
  ]
}