Loading malware…
NightClub is a modular Windows malware framework used since at least 2014 and associated with the MoustachedBouncer cyberespionage group. ESET reported that MoustachedBouncer has targeted foreign embassies in Belarus and has operated NightClub in parallel with the Disco toolset. NightClub uses email protocols for command and control, including SMTP and IMAP, and can also use SMTP and DNS for file exfiltration and C2.
Documented NightClub capabilities include monitoring removable drives, enumerating the active window via GetForegroundWindow, screen capture through a module using CreateCompatibleDC and GdipSaveImageToStream, and audio capture through a module leveraging the LAME encoder and mciSendStringW. It also captures files and keystrokes and copies them to the %TEMP% directory on compromised hosts.
For persistence, NightClub has created Windows services, including WmdmPmSp, and modified the Registry to set the ServiceDLL for a service created by the malware. The WmdmPmSp service was used to spoof a Windows Media service. NightClub also employed masquerading, including legitimate-looking filenames such as EsetUpdate-0117583943.exe for a dropper. Defense-evasion behavior includes modifying the creation, access, and write timestamps of malicious DLLs to match those of the legitimate Windows DLL user32.dll.
ESET reported additional NightClub implementation details across versions: a 2014 dropper wrote %SystemRoot%\System32\creh.dll and persisted via the WmdmPmSp service; a 2017 version stored plugins as DLLs under %APPDATA%\NvmFilter\ with a single export named Starts; 2020-2022 versions used an external JSON configuration file at %APPDATA%\Microsoft\def\Gfr45.cfg encrypted and decrypted with a hardcoded 2048-bit RSA private key; the orchestrator was named svhvost.exe and persisted via a service named vAwast; a module agent named schvost.exe loaded plugin DLLs disguised with a .ini extension. NightClub also included a DNS-tunneling backdoor plugin, ParametersParserer.dll, which exchanged commands and exfiltrated data via DNS TXT records using modified base64 encoding and domains ending in 11.1.1.cid and 12.1.1.cid. Known related indicators mentioned in the content include the service names WmdmPmSp and vAwast, filenames creh.dll, svhvost.exe, schvost.exe, EsetUpdate-0117583943.exe, the configuration path %APPDATA%\Microsoft\def\Gfr45.cfg, the plugin path %APPDATA%\NvmFilter, and the DNS suffixes 11.1.1.cid and 12.1.1.cid.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Since 2014, the group has been operating a malware framework that we have named NightClub. It uses the SMTP and IMAP (email) protocols for C&C communications.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
Catchamas creates three Registry keys to establish persistence by adding a Windows Service ... TEARDROP modified the Registry to create a Windows service for itself ... NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.
InvisiMole can collect data from the system, and can monitor changes in specified directories. NightClub can use a file monitor to steal specific files from targeted systems.
Agent Tesla can achieve persistence by modifying Registry key entries. Attor's dispatcher can modify the Run registry key. Kimsuky has also modified the registry entry for HKCU:\Software\Microsoft\Windows\CurrentVersion\Run registry key for persistence with the name WindowsSecurityCheck. PLAINTEE uses reg add to add a Registry Run key for persistence.
Catchamas creates three Registry keys to establish persistence by adding a Windows Service ... TEARDROP modified the Registry to create a Windows service for itself ... NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.
InvisiMole can collect data from the system, and can monitor changes in specified directories. NightClub can use a file monitor to steal specific files from targeted systems.
Agent Tesla can achieve persistence by modifying Registry key entries. Attor's dispatcher can modify the Run registry key. Kimsuky has also modified the registry entry for HKCU:\Software\Microsoft\Windows\CurrentVersion\Run registry key for persistence with the name WindowsSecurityCheck. PLAINTEE uses reg add to add a Registry Run key for persistence.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
Multiple malware families are described as identifying/enumerating open windows or capturing foreground window titles (e.g., via EnumWindows, GetForegroundWindow, GetWindowText) to understand user activity and provide context for keylogging/screencapture.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
"Agent Tesla can capture screenshots of the victim’s desktop"; "AppleSeed can take screenshots on a compromised host"; "APT28 has used tools to take screenshots from victims"; "Cobalt Strike's Beacon payload is capable of capturing screenshots"; "PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals"; "Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop"
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels... CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader... Kevin can send data from the victim host through a DNS C2 channel... NightClub can use SMTP and DNS for file exfiltration and C2.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware that aligns malicious DLL timestamps with legitimate Windows DLLs for stealth.
Modular C++ espionage implant framework used for embassy targeting. Uses email (SMTP/IMAP) for C2 and exfiltration, supports plugin delivery (e.g., keylogger, screenshotter, audio recorder, file monitor/stealer), and includes a DNS-tunneling backdoor module in later versions. Persists via Windows services and uses encrypted/externally stored configuration in newer variants.
Malware that creates a Windows service named WmdmPmSp for persistence.
Backdoor that loads a module using LAME encoder and mciSendStringW to control and capture audio.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.