H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[MoustachedBouncer](https://attack.mitre.org/groups/G1019) is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.(Citation: MoustachedBouncer ESET August 2023)

11 recorded

Relationships

uses

to Content Injection

Technique

uses

to Disco

Malware

uses

to Exploitation for Privilege Escalation

Technique

uses

to JavaScript

Technique

uses

to NightClub

Malware

uses

to PowerShell

Technique

uses

to Proxy

Technique

uses

to Remote Data Staging

Technique

uses

to Screen Capture

Technique

uses

to SharpDisco

Malware

uses

to Software Packing

Technique

2 external

References

mitre-attack

G1019

open

MoustachedBouncer ESET August 2023

https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/

open