Skip to content

Mustard Tempest

Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools.

ATT&CK ID: G1020
Weather family: Tempest
Techniques: 9
Tools: 2

Also tracked as DEV-0206 · TA569 · GOLD PRELUDE · UNC1543

Techniques

Resource Development

Acquire Infrastructure Compromise Infrastructure Stage Capabilities

Initial Access

Drive-by Compromise Phishing

Execution

Stealth

Discovery

System Information Discovery

Command and Control

Ingress Tool Transfer

Software

Cobalt Strike · SocGholish

MITRE ATT&CK All threat actors