Skip to content

MoustachedBouncer

MoustachedBouncer is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.

ATT&CK ID: G1019
Techniques: 7
Tools: 3

Vulnerabilities it has exploited

CVE-2021-1732 Microsoft Win32kUnscored · exploited in the wild

Techniques

Initial Access

Content Injection

Execution

Command and Scripting Interpreter

Privilege Escalation

Exploitation for Privilege Escalation

Stealth

Obfuscated Files or Information

Collection

Data Staged Screen Capture

Command and Control

Proxy Content Injection

Software

Disco · NightClub · SharpDisco

MITRE ATT&CK All threat actors