\n<\/p>\n
Hackers with apparent links to the Belarusian government have been targeting foreign diplomats in the country for nearly 10 years, according to security researchers.<\/p>\n
On Thursday, antivirus firm ESET published a report<\/a> that details the activities of a newly discovered government hacking group that the company has dubbed MoustachedBouncer. The group has likely been hacking or at least targeting diplomats by intercepting their connections at the internet service provider (ISP) level, suggesting close collaboration with Belarus\u2019 government, according to ESET.<\/p>\n Since 2014, MoustachedBouncer has targeted at least four foreign embassies in Belarus: two European nations, one from South Asia, and another from Africa.<\/p>\n \u201cThe operators were trained to find some confidential documents, but we\u2019re not sure exactly what they were looking for,\u201d ESET researcher Matthieu Faou told TechCrunch in an interview ahead of his talk at the Black Hat cybersecurity conference<\/a> in Las Vegas. \u201cThey are operating only inside Belarus against foreign diplomats. So we have never seen any attack by MustachedBouncer outside of Belarus.\u201d<\/p>\n ESET said it first detected MoustachedBouncer in February 2022, days after Russia invaded Ukraine, with a cyberattack against specific diplomats in the embassy of a European country \u201csomehow involved in the war,\u201d Faou said, declining to name the country.<\/p>\n By tampering with network traffic, the hacking group is able to trick the target\u2019s Windows operating system into believing it\u2019s connected to a network with a captive portal. The target is then redirected to a fake and malicious site masquerading as Windows Update, which warns the target that there are \u201ccritical system security updates that must be installed,\u201d according to the report.<\/p>\n It\u2019s not clear how MoustachedBouncer can intercept and modify traffic \u2014 a technique known as an adversary-in-the-middle, or AitM<\/a> \u2014 but ESET researchers believe it\u2019s because Belarusian ISPs are collaborating with the attacks, allowing the hackers to use a lawful intercept system similar to the one Russia deploys, known as SORM<\/a>.<\/p>\n The existence of this surveillance system has been known for years. In Belarus, all telecom providers \u201cmust make their hardware compatible with the SORM system,\u201d according to a 2016 Amnesty International report<\/a>.<\/p>\n Once ESET researchers found the attack last February and analyzed the malware used, they were able to discover other attacks \u2014 the oldest dating back to 2014\u00a0\u2014 although there is no trace of them between 2014 and 2018, according to Faou.<\/p>\n \u201cThey stayed under the radar for a long time. And so it means that they\u2019re quite successful if they were able to compromise high profile targets such as diplomats, while no one really spoke about them, and there have been very few malware samples available for analysis,\u201d he said. \u201cIt shows that they\u2019re quite careful when doing the operations.\u201d<\/p>\n Do you have information about this hacking group? Or other advanced persistent threats (APTs)? We\u2019d love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Wire @lorenzofb, or email lorenzo@techcrunch.com. You also can contact TechCrunch via SecureDrop<\/a>.<\/em><\/p>\n<\/p><\/div>\n