MoustachedBouncer
MoustachedBouncer is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--7251b44b-6072-476c-b8d9-a6e32c355b28
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T12:53:29+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (8)
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rath
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and
Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality m
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or
Software & Tools (3)
Disco is a custom implant that has been used by MoustachedBouncer
NightClub is a modular implant written in C++ that has been used by [MoustachedBouncer](https://attack.mitr
SharpDisco is a dropper developed in C# that has been used by [MoustachedBouncer](https://attack.mitre.org/
Explore this actor's full graph with Ninja Signal