MoustachedBouncer: AitM-Powered Surveillance via Belarus ISPs

An APT group conducting long-term espionage against diplomats, leveraging email-based C&C protocols, C++ modular backdoors, and adversary-in-the-middle (AitM) attacks… Sounds like the infamous Turla? Think again! We will introduce MoustachedBouncer: a group that's avoided the spotlight while displaying highly advanced capabilities that very much put the "A" in APT.

MoustachedBouncer has been using AitM in Belarus to redirect potential targets during captive portal checks. Targeted diplomats are shown fake Windows Update warnings and end up compromised with a custom malware …

advanced adversary adversary-in-the-middle aitm amp apt apt group attacks backdoors belarus capabilities email espionage isps modular moustachedbouncer protocols spotlight surveillance turla