MoustachedBouncer: AitM-Powered Surveillance via Belarus ISPs
summary
MoustachedBouncer uses ISP-level SORM/DPI interception in Belarus to perform targeted AitM, redirecting specific embassy IPs during the Windows captive-portal check to a fake Windows Update captive portal that drops a downloader. That downloader retrieves plugins over SMB (delivered via redirected traffic) and installs the Disco Go implant (scheduling tasks, SMB exfiltration, screenshotter, keylogger, audio recorder, LPE, reverse proxy). A separate lineage, Nightclub C++ backdoor, uses SMTP/IMAP and DNS-tunneling for covert C2 and file theft; operations date to 2014 and spike in 2022 against diplomats.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:45Presentation
- 1:30Who is Moustached
- 6:16Adverse Inal Attacks
- 12:29Possible Solutions
- 15:25Disco
- 18:24NineClub
- 22:04NineClub 2020
- 25:49DNST Backdoor
- 30:06Compromise Chain
- 31:47Exploit
related talks
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
49mThe Remote Malicious Butler Did It!
26mTracking the World's Dumbest Cyber Mercenaries
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
10mSurfacing from the Underbrush: Machete Pivots to Intrusion-Enabled Info Ops
47mDetecting and analyzing files-less malware
35mVPNFilter - YetAnotherBotNet Or Maybe Not...
56mCybersecurity & Privacy From The Global Lens