THREAT_ACTOR · G1019
MoustachedBouncer
Also known as: MoustachedBouncer
Profile
MoustachedBouncer is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.
MITRE ATT&CK ↗Techniques
8 ATT&CK techniques attributed to this actor.
Software
3 malware/tools attributed to this actor.
DiscoSharpDiscoNightClub
Related corpus activity
8,430 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to MoustachedBouncer.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2020-22658 | cve | — | 85 | 2 |
| cve-2025-7443 | cve | — | 85 | 1 |
| cve-2025-11837 | cve | — | 85 | 2 |
| cve-2020-22653 | cve | — | 85 | 2 |
| cve-2025-12057 | cve | — | 85 | 1 |
| cve-2017-17215 | cve | — | 85 | 2 |
| cve-2026-22584 | cve | — | 85 | 2 |
| cve-2013-3307 | cve | — | 85 | 2 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2026-3844 | cve | — | 85 | 1 |
| cve-2025-7852 | cve | — | 85 | 1 |
| cve-2016-0638 | cve | phishing | 85 | 1 |
| cve-2025-66478 | cve | — | 85 | 2 |
| cve-2025-0921 | cve | — | 85 | 2 |
| cve-2025-23304 | cve | — | 85 | 2 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2026-3102 | cve | — | 85 | 3 |
| cve-2016-5681 | cve | — | 85 | 2 |
| cve-2025-2492 | cve | — | 85 | 2 |
| cve-2026-4368 | cve | ransomware | 85 | 1 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2026-0740 | cve | — | 85 | 1 |
| cve-2025-34085 | cve | — | 85 | 1 |
| 625b6535321d58bb5c613e85332bf731 | hash | — | 80 | 3 |
| 5ab41cf20315d2ea1385967d588159873a65ef5581a0b78de06c0d8617894194 | sha256 | phishing | 80 | 2 |
| 2654c08491a0f7c4a3dfc6282de5638b | hash | — | 80 | 3 |
Showing the top 30 by severity of 8,430.