Disco
MITRE ATT&CK: S1088 View on attack.mitre.org
Aliases: Disco
- First seen
- 2020-01-01 00:00:00
- Malware type
- rat
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 8 (2 malicious)
- Last IoC activity
- 2026-09-02 01:03:00
- Profile updated
- 2026-07-07 13:05:32
Targeted industries: government-and-public-sector
Context
Disco is a custom implant that has been used by MoustachedBouncer since at least 2020 including in campaigns using targeted malicious content injection for initial access and command and control.
Recent IoC activity
2 malicious indicators in Maltiverse are attributed to Disco (S1088). The 2 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| hostname | ahkscript.org | 2026-09-03 | 1 |
| URL | http://ahkscript.org/download/1.1/AutoHotkey_1.1.34.04.zip | 2026-01-31 | 1 |
Detection coverage
- 128 Sigma rules
Malware & tools used
- Ingress Tool Transfer (attack-pattern)
- Content Injection (attack-pattern)
- Scheduled Task (attack-pattern)
- Malicious File (attack-pattern)
- File Transfer Protocols (attack-pattern)
Used by threat actors
- MoustachedBouncer (threat-actor)
Reports & references
- ESET — Moustachedbouncer Espionage Against Foreign Diplomats In Belarus (report)
- MITRE ATT&CK — S1088 (report)