MITRE ATT&CKgroup
G1020 Mustard Tempest
- Domain
- enterprise
- Aliases
- DEV-0206, TA569, GOLD PRELUDE, UNC1543
- Version
- 1.0
- Created
- 2023-12-06
Description
Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools.
Related
Uses · MITRE ATT&CK (14)
- S1124 SocGholish software (malware)
- T1583.008 Malvertising sub-technique
- T1608.006 SEO Poisoning sub-technique
- T1608.001 Upload Malware sub-technique
- T1608.004 Drive-by Target sub-technique
- T1583.004 Server sub-technique
- T1584.001 Domains sub-technique
- T1204.001 Malicious Link sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1189 Drive-by Compromise technique
- S0154 Cobalt Strike software (malware)
- T1082 System Information Discovery technique
- T1105 Ingress Tool Transfer technique
References
- https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update SocGholish-update
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ Microsoft Ransomware as a Service
- https://www.secureworks.com/research/threat-profiles/gold-prelude Secureworks Gold Prelude Profile