Threat Actor Profile
High APT
Description

MoustachedBouncer is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.(Citation: MoustachedBouncer ESET August 2023)

Confidence Score
90%
Known Aliases
MoustachedBouncer
Tags
mitre-attack stix-2.1 intrusion-set
First Seen

Unknown

Last Updated

Unknown

Active Status
Active
Created

April 29, 2026

MITRE ATT&CK Techniques (8)
T1074.002 - Remote Data Staging
Collection
T1113 - Screen Capture
Collection
T1090 - Proxy
Command and Control
T1027.002 - Software Packing
Defense Evasion
T1059.001 - PowerShell
Execution
T1059.007 - JavaScript
Execution
T1659 - Content Injection
Initial Access
T1068 - Exploitation for Privilege Escalation
Privilege Escalation
Indicators of Compromise

Loading IOCs…

IOC KQL for Sentinel
STIX Data 
{'aliases': ['MoustachedBouncer'],
 'created': '2023-09-25T18:11:05.672Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[MoustachedBouncer](https://attack.mitre.org/groups/G1019) is '
                'a cyberespionage group that has been active since at least '
                '2014 targeting foreign embassies in Belarus.(Citation: '
                'MoustachedBouncer ESET August 2023)',
 'external_references': [{'external_id': 'G1019',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G1019'},
                         {'description': 'Faou, M. (2023, August 10). '
                                         'MoustachedBouncer: Espionage against '
                                         'foreign diplomats in Belarus. '
                                         'Retrieved September 25, 2023.',
                          'source_name': 'MoustachedBouncer ESET August 2023',
                          'url': 'https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/'}],
 'id': 'intrusion-set--7251b44b-6072-476c-b8d9-a6e32c355b28',
 'modified': '2025-04-16T20:37:40.255Z',
 'name': 'MoustachedBouncer',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack', 'mobile-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '1.0'}
Quick Actions
Related TTPs (8)
Remote Data Staging
Collection
Screen Capture
Collection
Proxy
Command and Control
Software Packing
Defense Evasion
PowerShell
Execution
View All 8 TTPs
Back to Threat Actors
Dashboard Home