MoustachedBouncer

Summary

Espionage actor (MITRE G1019) that since at least 2014 has targeted only foreign embassies in Belarus — staff of two European, one South Asian and one African mission were identified. It hijacks victims' traffic at the ISP level to show fake Windows Update pages and push its NightClub and Disco toolsets; ESET believes it uses a lawful-interception system such as SORM, which ties it to access only a state could provide, and assesses with medium confidence that it is aligned with Belarus's interests. ESET dates its activity to 2014–2022.

Attribution

ISP-level interception implies state access

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• ESET Research (Research, 2023-08-10)
  Medium confidence: aligned with Belarus's interests
• ESET Research (Research, 2023-08-10)
  Uses a lawful-interception system, implying ISP-level state access

Campaigns 1

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 5

Malware and tools 3

Exploited vulnerabilities 1

Highest CVSS first.

Infrastructure patterns

• ISP-level AitM: captive-portal checks redirected to its C&C; fake Windows Update page (ESET, 2023; MITRE ATT&CK, 2026)
• Email as a C&C channel for some plugins — rare among APT groups (ESET, 2023)

Reporting and advisories 2

• MITRE ATT&CK
  MoustachedBouncer (G1019) group profile
• ESET Research
  MoustachedBouncer: espionage against foreign diplomats in Belarus