Introduction
Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools. Microsoft Ransomware as a Service Microsoft Threat Actor Naming July 2023 Secureworks Gold Prelude Profile SocGholish-update
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1583.008 Malvertising
- T1608.001 Upload Malware
- T1036.005 Match Legitimate Resource Name or Location
- T1566.002 Spearphishing Link
- T1584.001 Domains
- T1608.006 SEO Poisoning
- T1608.004 Drive-by Target
- T1189 Drive-by Compromise
- T1204.001 Malicious Link
- T1082 System Information Discovery
- T1583.004 Server
- T1105 Ingress Tool Transfer
ATT&CK technique IDs (denormalized)
- T1036.005
- T1082
- T1105
- T1189
- T1204.001
- T1566.002
- T1583.004
- T1583.008
- T1584.001
- T1608.001
- T1608.004
- T1608.006
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- CyberGate
- Cyber Eye RAT
- Cobalt Strike
MITRE ATT&CK Software
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [6] SocGholish-update Andrew Northern. (2022, November 22). SocGholish, a very real threat from a very fake update. Retrieved February 13, 2024. [7] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [8] Microsoft Ransomware as a Service Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023. [9] Secureworks Gold Prelude Profile Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.