H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[NightClub](https://attack.mitre.org/software/S1090) is a modular implant written in C++ that has been used by [MoustachedBouncer](https://attack.mitre.org/groups/G1019) since at least 2014.(Citation: MoustachedBouncer ESET August 2023)

Labels

malware

22 recorded

Relationships

uses

from MoustachedBouncer

Group

uses

to Application Window Discovery

Technique

uses

to Audio Capture

Technique

uses

to Data from Local System

Technique

uses

to DNS

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Keylogging

Technique

uses

to Local Data Staging

Technique

uses

to Mail Protocols

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

to Native API

Technique

uses

to Non-Standard Encoding

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Process Discovery

Technique

uses

to Screen Capture

Technique

uses

to Timestomp

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

S1090

open

MoustachedBouncer ESET August 2023

https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/

open