The Rise of the MoustachedBouncer: APT Spies Target Embassies and ISPs

Belarus-Linked APT Spied on Embassies through Local ISPs

Introduction

An advanced persistent threat (APT) known as “MoustachedBouncer,” believed to be aligned with the government of Belarus, has been engaging in an espionage campaign targeting staff in at least four embassies operating in the country. The APT used bespoke infostealer malware to compromise diplomats from southeast Asian, African, and European countries between 2017 and 2022. While the exact method of intrusion remains unclear, it is speculated that MoustachedBouncer leveraged the local Internet service provider (ISP) to carry out its spying activities. The case highlights the need for enhanced internet security measures, especially in countries where privacy laws are less stringent.

The Role of ISPs in Espionage

Researchers from ESET, a cybersecurity company, presented their findings on MoustachedBouncer at the Black Hat conference in Las Vegas. The APT is believed to have either infected routers at the targeted embassies or exploited lawful communications interception technology used by Belarus and Russia at the ISP level. The researchers noted that in most Western countries, privacy laws offer protection against such activities. However, in countries like Belarus, where such laws are lacking, organizations need to take extra precautions.

Leveraging Traffic Mangling at the ISP Level

ESET’s previous research on the Russian APT Turla indicated that manipulating HTTP requests at the ISP level enables cyber espionage. This approach is likely the same level at which MoustachedBouncer operated. The researchers made a significant observation that both Belarus and Russia possess the capability to spy on internet and phone networks through their respective systems for operative investigative activities (SORM). Amnesty International confirms that all telecommunications providers in Belarus are SORM-compatible. This insight points to the likelihood of MoustachedBouncer utilizing traffic mangling techniques at the ISP level instead of compromising routers.

MoustachedBouncer’s Techniques and Malware

MoustachedBouncer employed a fake Windows Update page to direct targeted computers to download their malware. The malware, known as “Disco,” is a modular framework capable of capturing screenshots, running PowerShell scripts, and exfiltrating data from the compromised machine. However, this method was ineffective against targets employing virtual private networks (VPNs). In those cases, MoustachedBouncer used “Nightclub,” another modular malware that could monitor and exfiltrate files, capture screenshots, log keystrokes, and record audio. The APT communicates with its command-and-control server solely via email, using the SMTP and IMAP protocols. The manner in which Nightclub was delivered to targets remains unknown.

An Efficient and Sophisticated Campaign

To evade detection for almost a decade, MoustachedBouncer demonstrated several factors that contributed to its success. Firstly, it targeted a limited number of victims each year, making it harder to track their activities. Secondly, the campaign showed a high level of technical sophistication, making it less typical compared to other known APTs.

Editorial: Heightened Internet Security Measures are Essential

MoustachedBouncer’s espionage campaign targeting foreign embassies highlights the significance of robust internet security measures, particularly in regions where privacy laws may be lacking or insufficiently enforced. While the exact scope of the APT‘s activities is not fully known, it is evident that both routers and ISPs can serve as potential attack vectors for cyber espionage. Governments and organizations should prioritize the adoption of secure practices, such as employing VPNs, to safeguard their communications and data. In addition, maintaining updated and fortified defenses against malware, including regularly patching systems and integrating robust endpoint protection, is vital to mitigate the risk of infiltration.

Advice for Organizations Operating in Challenging Environments

Organizations operating in countries with limited privacy protections should take comprehensive measures to protect their sensitive data and communications. The following steps are crucial in enhancing internet security:

1. Utilize Virtual Private Networks (VPNs)

Organizations should ensure that all network traffic, including internal communications and internet connections, is encrypted and routed through a secure VPN. This will help protect against potential interception and monitoring by threat actors.

2. Implement Multi-Factor Authentication (MFA)

Enforcing MFA across all systems and applications provides an additional layer of security, making it more challenging for adversaries to gain unauthorized access to sensitive information.

3. Regularly Update and Patch Systems

Keeping all software and systems up to date with the latest security patches helps protect against known vulnerabilities that threat actors may exploit.

4. Train and Educate Employees

Employees should receive regular training on internet security best practices, including how to recognize and report suspicious emails or activities that could potentially lead to a cyber incident.

5. Deploy Robust Endpoint Protection

Implementing comprehensive endpoint protection solutions helps detect and prevent malware infections. This should include advanced capabilities such as behavior monitoring and real-time threat intelligence.

6. Maintain Regular Backups

Regularly backing up critical data and storing it securely helps organizations quickly recover in case of a cyber attack or data breach.

7. Conduct Regular Security Audits

Regular security audits and assessments can identify vulnerabilities and weaknesses in an organization’s network infrastructure and systems. This enables proactive mitigation of potential risks and strengthens overall security posture.

By adopting these security measures, organizations operating in challenging environments can significantly reduce their exposure to potential cyber threats and ensure the integrity and confidentiality of their data and communications.