Thursday, May 8, 2025
HomeCyber AttackMoustachedBouncer Attacking Foreign Embassies Using NightClub and Disco Hacking Tools

MoustachedBouncer Attacking Foreign Embassies Using NightClub and Disco Hacking Tools

Published on

SIEM as a Service

Follow Us on Google News

MoustachedBouncer, a cyberespionage group active since 2014, likely has performed ISP-level adversary-in-the-middle (AitM) attacks since 2020 to compromise its targets.

For AitM, the MoustachedBouncer employs a lawful interception system like “SORM,” and besides this, it uses two toolsets that we have mentioned below:-

  • NightClub
  • Disco

Cybersecurity researchers at ESET recently identified that MoustachedBouncer, reportedly backed by Belarus, targets foreign diplomats using its two toolsets that we have mentioned above from the following countries for nearly a decade:-

- Advertisement - Google News
  • Europe
  • South Asia
  • Africa 
Document
FREE Webinar

API Security Fundamentals: How to Discover, Scan and Protect APIs

API Attacks Have Increased by 400% – Understand the Fundamentals of Protecting Your APIs with a Positive Security Model – Register Now for a Free Webinar

MoustachedBouncer Attacking Foreign Embassies

While it’s been suspected that MoustachedBouncer collaborated with Winter Vivern, active since 2021. Not only that even they also manipulated the victim’s ISP access and tricked the Windows 10 operating system with the imprisoned portal illusion.

ESET telemetry shows MoustachedBouncer targets embassies in Belarus, with staff from four countries affected:-

  • Two from European
  • One from South Asian
  • One from African
MoustachedBouncer activity timeline (Source – ESET)

Over time, the TTPs of the group evolved dramatically and it’s been active from 2014 to 2022. However, the AitM attacks by the group are observed in 2020, but, here the exceptional thing is that the targeted verticals remain the same.

MoustachedBouncer manipulates ISP to redirect victims in targeted IP ranges to deceptive, genuine-looking Windows Update URLs that we have mentioned below:-

  • http://updates.microsoft[.]com/

Victims encounter fake Windows Update pages with urgent security alerts, in which users are provided with a button that is dubbed “Get updates,” clicking on it triggers malicious file download through executed JavaScript.

Fake Windows Update Page (Source – ESET)

MoustachedBouncer’s AitM technique resembles Turla and StrongPity, which trojanize installers at the ISP level, similar to MoustachedBouncer’s approach.

Compromise via AitM (Source – ESET)

It’s been suspected that the collaboration of MoustachedBouncer with Belarusian ISPs for a legal intercept system is completely similar to Russia’s SORM, executed by a 2016 mandate requiring telecom providers’ compatibility.

The HTML page fetches JavaScript from http://updates.microsoft[.]com/jdrop.js, scheduling function ‘jdrop’ after one second, which displays a modal with a ‘Get updates’ button.

jdrop function (Source – ESET)

Moreover, the MoustachedBouncer uses two implant families in parallel but deploys only one on a machine like:-

  • Disco likely used with AitM
  • NightClub for VPN-protected victims outside Belarus

Apart from this, NightClub has two primary capabilities, and here below we have mentioned them:-

  • Monitoring files
  • Exfiltrating data via SMTP (email)

All these key factors confirm that MoustachedBouncer is a skilled threat actor and actively targets the diplomats in Belarus by employing advanced techniques for C&C communication.

Advanced techniques that are observed:-

  • For ISP-level interception it used Disco
  • For emails, it used NightClub
  • For DNS, it used the NightClub plugin

ESET started investigating in Feb 2022, finding a cyberattack on a European embassy. Analyzing the malware revealed a track dating to 2014, showcasing the group’s stealth in targeting diplomats.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Cisco IOS, XE, and XR Vulnerability Allows Remote Device Reboots

 Cisco has issued an urgent security advisory (cisco-sa-twamp-kV4FHugn) warning of a critical vulnerability in...

OpenCTI: Free Cyber Threat Intelligence Platform for Security Experts

OpenCTI (Open Cyber Threat Intelligence) stands out as a free, open source platform specifically...

LockBit Ransomware Group Breached: Internal Chats and Data Leaked Online

The notorious LockBit ransomware group, once considered one of the world’s most prolific cyber...

Cisco IOS XE Wireless Controllers Vulnerability Lets Attackers Seize Full Control

A critical security flaw has been discovered in Cisco IOS XE Wireless LAN Controllers...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Cisco IOS, XE, and XR Vulnerability Allows Remote Device Reboots

 Cisco has issued an urgent security advisory (cisco-sa-twamp-kV4FHugn) warning of a critical vulnerability in...

OpenCTI: Free Cyber Threat Intelligence Platform for Security Experts

OpenCTI (Open Cyber Threat Intelligence) stands out as a free, open source platform specifically...

LockBit Ransomware Group Breached: Internal Chats and Data Leaked Online

The notorious LockBit ransomware group, once considered one of the world’s most prolific cyber...