Threat actor · G1020

Mustard Tempest

Also known as DEV-0206, TA569, GOLD PRELUDE, UNC1543.

Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools.

ATT&CK techniques

12 mapped

T1036.005 T1082 T1105 T1189 T1204.001 T1566.002 T1583.004 T1583.008 T1584.001 T1608.001 T1608.004 T1608.006