Foreign embassies in Belarus are being targeted by an undocumented threat actor codenamed “MoustachedBouncer” who has been operating for nearly a decade. The threat actor has been conducting cyber espionage attacks aimed at foreign embassies in Belarus dating back to at least 2014 and has two (2) signature malware frameworks named “Disco” and “NightClub”. Disco was released more recently in 2020 with capabilities to support data theft, capture screenshots, record audio, capture keystrokes, and more. Both frameworks have additional plug-ins to support overlapping capabilities, but NightClub is used more in instances where traffic interception is not possible, such as when an embassy uses VPN services to route traffic outside of Belarus. Researchers have observed the threat actor using five (5) distinct campaigns over the years, shifting tactics in 2020 when it likely began to perform adversary-in-the-middle (AitM) attacks at the internet service provider (ISP) level. The skilled and advanced actor is believed to be exploiting local Belarusian ISPs to compromise its targets and steal data. Researchers believe the group to be aligned with Belarusian interests.