MoustachedBouncer: Espionage against foreign diplomats in Belarus
Source CIRCL OSINT Feed
0
TLP:WHITE, disclosure is not limited
Description
MoustachedBouncer is an espionage campaign targeting foreign diplomats in Belarus. The activity involves intelligence gathering against diplomatic personnel, as identified by open-source intelligence (OSINT) sources. There are no specific technical details, affected software versions, or known exploits associated with this campaign. The threat is assessed as high severity due to its espionage nature and targeted geopolitical focus.
Indicators of compromise
Domains 6
- updates.microsoft.com
- securityocspdev.com
- centrocspupdate.com
- ocsp-atomsecure.com
- dervasopssec.com
- windows.network.troubleshooter.com
URLs 11
- http://updates.microsoft.com
- http://updates.microsoft.com/jdrop.js
- http://updates.microsoft.com/MicrosoftUpdate845255.zip
- smb://38.9.8.78/driverpack/DPU.exe
- smb://209.19.37.184/driverpack/aact.exe
- smb://209.19.37.184/driverpack/officetelemetry.exe
- smb://52.3.8.25/oracle/oracleTelemetry.exe
- smb://59.6.8.25/outlooksync/outlooksync.exe
- smb://24.9.51.94/EDGEUPDATE/
- smb://24.9.51.94/EDGEUPDATE/update/
IP addresses 11
- 38.9.8.78
- 209.19.37.184
- 52.3.8.25
- 59.6.8.25
- 24.9.51.94
- 35.214.56.2[Auto] IDS disabled by warninglist checker. Matched: List of known GCP (Google Cloud Platform) IP address ranges
- 45.136.199.67
- 185.87.148.86
- 185.87.151.130
- 45.136.199.129
Hashes 87
Email addresses 4
- glen.morriss75@seznam.czEmail address used by NightClub.
- fhtgbbwi@mail.ruEmail address used by NightClub.
- nvjfnvjfnjf@mail.ruEmail address used by MoustachedBouncer operators.
- sunyaf@seznam.czEmail address used by MoustachedBouncer operators.
Target location 1
- BY
Text 92
- Foreign diplomatic mission
- ESET
- JS/TrojanDownloader.Agent.YJJ
- http
- http
- /jdrop.js
- ESET
- WinGo/Agent.ET
- exe
- http
Port 4
- 80
- 80
- 80
- 80
File 31
- index.html
- jdrop.js
- MicrosoftUpdate845255.exe
- driverpackUpdate.exe
- DPU.exe
- sdrive.exe
- nod32update.exe
- aact.exe
- officetelemetry.exe
- oracleTelemetry.exe
Datetime 31
- 1970-01-01T00:00:00+00:00
- 1970-01-01T00:00:00+00:00
- 1970-01-01T00:00:00+00:00
- 2021-11-29T13:33:00+00:00
- 1970-01-01T00:00:00+00:00
- 1970-01-01T00:00:00+00:00
- 1970-01-01T00:00:00+00:00
- 1970-01-01T00:00:00+00:00
- 1970-01-01T00:00:00+00:00
- 2019-12-31T08:40:06+00:00
Imphash 31
- c7269d59926fa4252270f407e4dab043
- c7269d59926fa4252270f407e4dab043
- c7269d59926fa4252270f407e4dab043
- ef263ccd3c50525efd62546d5922e7de
- c7269d59926fa4252270f407e4dab043
- c7269d59926fa4252270f407e4dab043
- 4035d2883e01d64f3e7a9dccb1d63af5
- a56f115ee5ef2625bd949acaeec66b76
- c7269d59926fa4252270f407e4dab043
- f34d5f2d4577ed6d9ceec516c1f5a744
Authentihash 31
- 85aec9a10f2b988b3426bd704dfc26ae8ab549c876f27d1e1c4bbce0f9de3ce6
- c016e33501534b84afae053928410f273631ac73f712a059d1dbe613fdbf1cdf
- 8fbd81ffe1d2361607673bc002492ab67e83a512600c3fb8890283ffb5656564
- 31f087f93e353bc1d79a31bc80e242991a79bda48eea27f49a57f90ad913f7d3
- dfe87b9de008e466a174a8930e7b93d3d8b580857e7c6d1da847adee373067bc
- 58ee19a2e8e695c300e6857923c12257c6b6448203cfe1588a94011d31c7d199
- 2bcc0ed647811018dff4387d0294ce8855d97fac865a582972cb0f469a06efea
- 5e08b28cbdb4e680b2938e43ae46a0cc402cc33d199e408817a9d50c81e7d374
- 8b4487327711ce2045032e9bc013a4024846137d187a311146807dcc0f33c580
- 8f45749ded6c56a96d79f45f305542bdef89b858b354130d3c6bbacc31a23a04
Community reviews
Loading reviews…