LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1090: NightClub

NightClub is a modular implant written in C++ that has been used by MoustachedBouncer since at least 2014.[1]

EnterpriseS1090MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

NightClub matters because ATT&CK describes it as a Windows modular C++ implant associated through relationships with long-running espionage activity. The practical concern is not a single exploit, but post-compromise capability: discovery, collection, credential capture via keylogging, local staging, command-and-control over DNS or mail protocols, and exfiltration over the C2 channel. For leaders, this is a coverage question: can the organization prove it would see a Windows implant behaving quietly across endpoint, registry, service, file, and network layers?

Executive priority

Prioritize NightClub as an espionage-style readiness test for Windows estates, especially where sensitive communications, diplomatic, regulated, or executive data are present. Because the ATT&CK object has no official detection guidance, leadership should ask for evidence of telemetry coverage and response procedures rather than assume tool coverage. This supports business continuity, compliance evidence, and incident decision-making by validating whether the SOC can detect collection, persistence, stealth, and unusual DNS/mail-based outbound activity before data leaves the environment.

Technical view

NightClub is listed as Windows malware, while its mapped behaviors include collection, discovery, command-and-control, exfiltration, persistence, privilege escalation, and defense evasion techniques. SOC and IR teams should validate detections around Windows service creation or modification, registry modification, process and file discovery, local data staging, suspicious file naming or locations, timestamp manipulation, tool transfer, keylogging indicators, screen/audio capture, and anomalous DNS or mail-protocol communications. The relationship to MoustachedBouncer provides threat-intelligence context, but local detection should be behavior-led because ATT&CK does not provide NightClub-specific detection logic.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Windows service creation, modification, and service configuration records
  • Windows Registry modification telemetry
  • File creation, rename, placement, metadata, and timestamp-change evidence
  • Endpoint alerts or logs for keylogging, screen capture, audio capture, and peripheral interaction where available

Detection direction

  • Do not rely on a NightClub signature alone; ATT&CK supplies no official detection text, so validate behavior-based coverage across the mapped techniques.
  • Tune Windows service and registry detections to separate legitimate administration from unusual new services, modified service paths, suspicious descriptions, or persistence-like changes.
  • Correlate discovery activity with later collection, staging, and outbound traffic rather than alerting on single benign commands in isolation.
  • Review blind spots in DNS and mail-protocol monitoring, since these protocols are mapped as possible C2 channels and are often broadly allowed.
  • Look for stealth context such as timestomping, masqueraded service names, or files placed/named to resemble legitimate resources.

Mitigation priorities

  • Confirm complete Windows endpoint logging and retention for process, service, registry, file, and network events before tuning advanced analytics.
  • Harden persistence paths by limiting who can create or modify Windows services and sensitive Registry locations.
  • Apply least privilege and administrative access controls to reduce the value of registry, service, and local data access.
  • Restrict and monitor outbound DNS and mail-protocol usage according to business need; investigate hosts that generate unusual protocol patterns.
  • Use application control or allowlisting where feasible to reduce execution of unauthorized implants or transferred tools.
Additional notes and limits

The supplied ATT&CK record identifies NightClub as a Windows modular implant written in C++ and used by MoustachedBouncer since at least 2014. Relationship mappings provide the most useful defensive context, showing behaviors across collection, discovery, C2, exfiltration, stealth, persistence, and registry/service activity. The associated group description notes cyberespionage activity targeting foreign embassies in Belarus, but this should be treated as context from ATT&CK, not as evidence of local targeting.

ATT&CK provides no official detection guidance, no aliases, no explicit tactics on the malware object, and no environment-specific indicators here. This take therefore focuses on behavior and control validation rather than confirmed detection logic, active exploitation, or customer exposure. Local asset inventory, logging architecture, DNS/mail routing, endpoint control configuration, and incident evidence are required to determine actual risk and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

NightClub

NightClub is a modular implant written in C++ that has been used by MoustachedBouncer since at least 2014.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

21 rows
DomainIDNameRelationship / procedure
EnterpriseT1543.003Windows ServiceSub-technique

NightClub has created a Windows service named `WmdmPmSp` to establish persistence.[1]

EnterpriseT1041Exfiltration Over C2 Channel

NightClub can use SMTP and DNS for file exfiltration and C2.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

NightClub has chosen file names to appear legitimate including EsetUpdate-0117583943.exe for its dropper.[1]

EnterpriseT1005Data from Local System

NightClub can use a file monitor to steal specific files from targeted systems.[1]

EnterpriseT1106Native API

NightClub can use multiple native APIs including `GetKeyState`, `GetForegroundWindow`, `GetWindowThreadProcessId`, and `GetKeyboardLayout`.[1]

EnterpriseT1083File and Directory Discovery

NightClub can use a file monitor to identify .lnk, .doc, .docx, .xls, .xslx, and .pdf files.[1]

EnterpriseT1071.004DNSSub-technique

NightClub can use a DNS tunneling plugin to exfiltrate data by adding it to the subdomain portion of a DNS request.[1]

EnterpriseT1070.006TimestompSub-technique

NightClub can modify the Creation, Access, and Write timestamps for malicious DLLs to match those of the genuine Windows DLL user32.dll.[1]

EnterpriseT1132.002Non-Standard EncodingSub-technique

NightClub has used a non-standard encoding in DNS tunneling removing any `=` from the result of base64 encoding, and replacing `/` characters with `-s` and `+` characters with `-p`.[1]

EnterpriseT1071.003Mail ProtocolsSub-technique

NightClub can use emails for C2 communications.[1]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

NightClub has created a service named `WmdmPmSp` to spoof a Windows Media service.[1]

EnterpriseT1010Application Window Discovery

NightClub can use `GetForegroundWindow` to enumerate the active window.[1]

EnterpriseT1056.001KeyloggingSub-technique

NightClub can use a plugin for keylogging.[1]

EnterpriseT1113Screen Capture

NightClub can load a module to call `CreateCompatibleDC` and `GdipSaveImageToStream` for screen capture.[1]

EnterpriseT1105Ingress Tool Transfer

NightClub can load multiple additional plugins on an infected host.[1]

EnterpriseT1027Obfuscated Files or Information

NightClub can obfuscate strings using the congruential generator `(LCG): staten+1 = (690069 × staten + 1) mod 232`.[1]

EnterpriseT1057Process Discovery

NightClub has the ability to use `GetWindowThreadProcessId` to identify the process behind a specified window.[1]

EnterpriseT1120Peripheral Device Discovery

NightClub has the ability to monitor removable drives.[1]

EnterpriseT1123Audio Capture

NightClub can load a module to leverage the LAME encoder and `mciSendStringW` to control and capture audio.[1]

EnterpriseT1074.001Local Data StagingSub-technique

NightClub has copied captured files and keystrokes to the `%TEMP%` directory of compromised hosts.[1]

EnterpriseT1112Modify Registry

NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.[1]

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

uses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1071.004: DNSEnterpriseuses · GroupG1019: MoustachedBouncerEnterpriseuses · TechniqueT1070.006: TimestompEnterpriseuses · TechniqueT1132.002: Non-Standard EncodingEnterpriseuses · TechniqueT1071.003: Mail ProtocolsEnterpriseuses · TechniqueT1036.004: Masquerade Task or ServiceEnterpriseuses · TechniqueT1010: Application Window DiscoveryEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1120: Peripheral Device DiscoveryEnterpriseuses · TechniqueT1123: Audio CaptureEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1112: Modify RegistryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
9a6bcfdfc1f5aa6b...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle9a6bcfdfc1f5…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  2. [2]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  3. [3]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  4. [4]
    mitre-attackS1090
    Open source URL
  5. [5]
    mitre-attackS1090
    Open source URL
  6. [6]
    mitre-attackS1090
    Open source URL
  7. [7]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  8. [8]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  9. [9]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  10. [10]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  11. [11]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  12. [12]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  13. [13]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  14. [14]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  15. [15]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  16. [16]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  17. [17]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  18. [18]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  19. [19]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  20. [20]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  21. [21]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  22. [22]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  23. [23]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  24. [24]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  25. [25]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  26. [26]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  27. [27]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  28. [28]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  29. [29]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  30. [30]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  31. [31]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  32. [32]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  33. [33]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  34. [34]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  35. [35]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  36. [36]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  37. [37]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  38. [38]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  39. [39]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  40. [40]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  41. [41]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  42. [42]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  43. [43]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  44. [44]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  45. [45]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  46. [46]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  47. [47]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  48. [48]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
  49. [49]
    MoustachedBouncer ESET August 2023

    Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use