Disco | Netskope Threat Labs

Description

Disco is a custom implant that the MoustachedBouncer threat actor has used since at least 2020, including campaigns that used targeted malicious content injection for initial access and command and control.

Stats

First seen: May 2022
Last seen: September 2026

MITRE ATT&CK techniques

5 techniques across 3 tactics.

TA0001 Initial Access

T1659Content Injection

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1204User Execution
- T1204.002Malicious File

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.002File Transfer Protocols
T1105Ingress Tool Transfer

Associated groups

G1019MoustachedBouncer

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Backdoor.Disco	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Infostealer.Disco	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Spyware.Disco	ATP Sandbox Adv. Heuristics
MacOS.Backdoor.Disco	ATP Sandbox Adv. Heuristics
MacOS.Infostealer.Disco	ATP Sandbox Adv. Heuristics
Script-JS.Infostealer.Disco	ATP Sandbox Adv. Heuristics
Script-Python.Trojan.Disco	ATP Sandbox Adv. Heuristics
Win32.Infostealer.Disco	ATP Sandbox Adv. Heuristics
Win32.Trojan.Disco	ATP Sandbox Adv. Heuristics
Win64.Infostealer.Disco	ATP Sandbox Adv. Heuristics
Win64.Trojan.Disco	ATP Sandbox Adv. Heuristics

Related blogs

$Sandbox process tree for the Underground loader, showing an injected dllhost.exe launching chrome.exe and msedge.exe and staging stolen cookies under C:\ProgramData\Underground, before a second dllhost.exe deletes that folder.$