MoustachedBouncer

MoustachedBouncer, a threat actor first detailed in August 2023, is known for its cyberespionage activities primarily targeting foreign diplomats in Belarus. The group has been linked to at least four attacks on foreign embassies in Belarus since 2014, including two European nations, one from South Asia, and another from Africa. MoustachedBouncer's tactics involve adversary-in-the-middle (AitM) attacks executed through Belarusian internet service providers (ISPs). This approach allows the group to intercept and manipulate communications, posing significant threats to diplomatic entities within the country. The group's modus operandi includes the use of a specific Command and Control (C&C) protocol referred to as transport_http, an expression typically used by Russian-speaking threat actors such as Turla. This linguistic hint, along with the group's sophisticated tactics, suggests that the developers behind MoustachedBouncer may be Russian speakers. Furthermore, the group utilizes a C# developed dropper named SharpDisco to issue HTTP redirections, further enhancing their ability to control and monitor targeted systems. There are indications of a potential link between MoustachedBouncer and another threat actor known as Winter Vivern, although this connection is currently assessed with low confidence. The GoldenHowl malware, associated with these groups, underscores the danger of these attacks, capable of infiltrating even highly secure systems via USB-based methods. As MoustachedBouncer continues to exploit access to Belarus ISPs for espionage purposes, it remains a significant cybersecurity concern.