Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools.1234
- Microsoft Ransomware as a Service
- Microsoft Threat Actor Naming July 2023
- Secureworks Gold Prelude Profile
- SocGholish-update
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Mustard Tempest | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DEV-0206 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TA569 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | GOLD PRELUDE | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | UNC1543 | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.008 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2023 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1082 | System Information Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1189 | Drive-by Compromise | — |
| T1204.001 | Malicious Link | — |
| T1566.002 | Spearphishing Link | — |
| T1583.004 | Server | — |
| T1583.008 | Malvertising | — |
| T1584.001 | Domains | — |
| T1608.001 | Upload Malware | — |
| T1608.004 | Drive-by Target | — |
| T1608.006 | SEO Poisoning | — |
Aliases
DEV-0206 · GOLD PRELUDE · Mustard Tempest · TA569 · UNC1543
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.