Monday, November 4, 2024
HomeCyber AttackMoustachedBouncer Attacking Foreign Embassies Using NightClub and Disco Hacking Tools

MoustachedBouncer Attacking Foreign Embassies Using NightClub and Disco Hacking Tools

Published on

Malware protection

MoustachedBouncer, a cyberespionage group active since 2014, likely has performed ISP-level adversary-in-the-middle (AitM) attacks since 2020 to compromise its targets.

For AitM, the MoustachedBouncer employs a lawful interception system like “SORM,” and besides this, it uses two toolsets that we have mentioned below:-

  • NightClub
  • Disco

Cybersecurity researchers at ESET recently identified that MoustachedBouncer, reportedly backed by Belarus, targets foreign diplomats using its two toolsets that we have mentioned above from the following countries for nearly a decade:-

- Advertisement - SIEM as a Service
  • Europe
  • South Asia
  • Africa 
Document
FREE Webinar

API Security Fundamentals: How to Discover, Scan and Protect APIs

API Attacks Have Increased by 400% – Understand the Fundamentals of Protecting Your APIs with a Positive Security Model – Register Now for a Free Webinar

MoustachedBouncer Attacking Foreign Embassies

While it’s been suspected that MoustachedBouncer collaborated with Winter Vivern, active since 2021. Not only that even they also manipulated the victim’s ISP access and tricked the Windows 10 operating system with the imprisoned portal illusion.

ESET telemetry shows MoustachedBouncer targets embassies in Belarus, with staff from four countries affected:-

  • Two from European
  • One from South Asian
  • One from African
MoustachedBouncer activity timeline (Source – ESET)

Over time, the TTPs of the group evolved dramatically and it’s been active from 2014 to 2022. However, the AitM attacks by the group are observed in 2020, but, here the exceptional thing is that the targeted verticals remain the same.

MoustachedBouncer manipulates ISP to redirect victims in targeted IP ranges to deceptive, genuine-looking Windows Update URLs that we have mentioned below:-

  • http://updates.microsoft[.]com/

Victims encounter fake Windows Update pages with urgent security alerts, in which users are provided with a button that is dubbed “Get updates,” clicking on it triggers malicious file download through executed JavaScript.

Fake Windows Update Page (Source – ESET)

MoustachedBouncer’s AitM technique resembles Turla and StrongPity, which trojanize installers at the ISP level, similar to MoustachedBouncer’s approach.

Compromise via AitM (Source – ESET)

It’s been suspected that the collaboration of MoustachedBouncer with Belarusian ISPs for a legal intercept system is completely similar to Russia’s SORM, executed by a 2016 mandate requiring telecom providers’ compatibility.

The HTML page fetches JavaScript from http://updates.microsoft[.]com/jdrop.js, scheduling function ‘jdrop’ after one second, which displays a modal with a ‘Get updates’ button.

jdrop function (Source – ESET)

Moreover, the MoustachedBouncer uses two implant families in parallel but deploys only one on a machine like:-

  • Disco likely used with AitM
  • NightClub for VPN-protected victims outside Belarus

Apart from this, NightClub has two primary capabilities, and here below we have mentioned them:-

  • Monitoring files
  • Exfiltrating data via SMTP (email)

All these key factors confirm that MoustachedBouncer is a skilled threat actor and actively targets the diplomats in Belarus by employing advanced techniques for C&C communication.

Advanced techniques that are observed:-

  • For ISP-level interception it used Disco
  • For emails, it used NightClub
  • For DNS, it used the NightClub plugin

ESET started investigating in Feb 2022, finding a cyberattack on a European embassy. Analyzing the malware revealed a track dating to 2014, showcasing the group’s stealth in targeting diplomats.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...