Disco

First seen

2020-01-01 00:00:00

Malware type

rat

Family

Malware family

Operating systems

windows

Related IoCs

27 (11 malicious)

Last IoC activity

2026-10-18 03:01:57

Profile updated

2026-07-07 13:05:32

Targeted industries: government-and-public-sector

Context

Disco is a custom implant that has been used by MoustachedBouncer since at least 2020 including in campaigns using targeted malicious content injection for initial access and command and control.

Recent IoC activity

11 malicious indicators in Maltiverse are attributed to Disco (S1088). The 11 most recently updated:

Detection coverage

• 128 Sigma rules

Malware & tools used

• Ingress Tool Transfer (attack-pattern)
• Content Injection (attack-pattern)
• Scheduled Task (attack-pattern)
• Malicious File (attack-pattern)
• File Transfer Protocols (attack-pattern)

Used by threat actors

• MoustachedBouncer (threat-actor)

Reports & references

• ESET — Moustachedbouncer Espionage Against Foreign Diplomats In Belarus (report)
• MITRE ATT&CK — S1088 (report)

External references

• mitre-attack — S1088
• MoustachedBouncer ESET August 2023
• misp-galaxy
• misp-galaxy