G1019 MoustachedBouncer

MoustachedBouncer is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.¹

Techniques Used

Domain	ID	Name	Use
enterprise	T1059	Command and Scripting Interpreter	-
enterprise	T1059.001	PowerShell	MoustachedBouncer has used plugins to execute PowerShell scripts.¹
enterprise	T1059.007	JavaScript	MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.¹
enterprise	T1659	Content Injection	MoustachedBouncer has injected content into DNS, HTTP, and SMB replies to redirect specifically-targeted victims to a fake Windows Update page to download malware.¹
enterprise	T1074	Data Staged	-
enterprise	T1074.002	Remote Data Staging	MoustachedBouncer has used plugins to save captured screenshots to `.\AActdata\` on an SMB share.¹
enterprise	T1068	Exploitation for Privilege Escalation	MoustachedBouncer has exploited CVE-2021-1732 to execute malware components with elevated rights.¹
enterprise	T1027	Obfuscated Files or Information	-
enterprise	T1027.002	Software Packing	MoustachedBouncer has used malware plugins packed with Themida.¹
enterprise	T1090	Proxy	MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.¹
enterprise	T1113	Screen Capture	MoustachedBouncer has used plugins to take screenshots on targeted systems.¹
mobile	T1655	Masquerading	-
mobile	T1655.001	Match Legitimate Name or Location	MoustachedBouncer has used legitimate looking filenames for malicious executables including MicrosoftUpdate845255.exe.¹

ID	Name	References	Techniques
S1088	Disco	¹	File Transfer Protocols:Application Layer Protocol Content Injection Ingress Tool Transfer Scheduled Task:Scheduled Task/Job Malicious File:User Execution
S1090	NightClub	¹	DNS:Application Layer Protocol Mail Protocols:Application Layer Protocol Application Window Discovery Audio Capture Windows Service:Create or Modify System Process Non-Standard Encoding:Data Encoding Data from Local System Local Data Staging:Data Staged Exfiltration Over C2 Channel File and Directory Discovery Timestomp:Indicator Removal Ingress Tool Transfer Keylogging:Input Capture Match Legitimate Resource Name or Location:Masquerading Masquerade Task or Service:Masquerading Modify Registry Native API Obfuscated Files or Information Peripheral Device Discovery Process Discovery Screen Capture
S1089	SharpDisco	¹	File Transfer Protocols:Application Layer Protocol Windows Command Shell:Command and Scripting Interpreter Data from Local System Exfiltration Over C2 Channel File and Directory Discovery Hidden Window:Hide Artifacts Ingress Tool Transfer Local Storage Discovery Native API Peripheral Device Discovery Scheduled Task:Scheduled Task/Job