MITRE ATT&CKsoftware (malware)

S1124 SocGholish

Published 2024-03-22 Modified 2024-04-06 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
FakeUpdates
Version
1.0
Created
2024-03-22

Description

SocGholish is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily through drive-by-downloads masquerading as software updates. SocGholish is operated by Mustard Tempest and its access has been sold to groups including Indrik Spider for downloading secondary RAT and ransomware payloads.

Related

Uses · MITRE ATT&CK (19)

  • T1027.015 Compression sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1614 System Location Discovery technique
  • T1059.007 JavaScript sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1518 Software Discovery technique
  • T1482 Domain Trust Discovery technique
  • T1189 Drive-by Compromise technique
  • T1016 System Network Configuration Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1102 Web Service technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

  • G1020 Mustard Tempest group

References