Home / Threat actors / Mustard Tempest

Mustard Tempest G1020

🔔 Create alert

Also known as: DEV-0206, TA569, GOLD PRELUDE, UNC1543

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

12

Techniques

2

Malware and tools

Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1583.004 Server T1583.008 Malvertising T1584.001 Domains T1608.001 Upload Malware T1608.004 Drive-by Target T1608.006 SEO Poisoning

Initial Access

T1189 Drive-by Compromise T1566.002 Spearphishing Link

Execution

T1204.001 Malicious Link

Stealth

T1036.005 Match Legitimate Resource Name or Location

Discovery

T1082 System Information Discovery

Command and Control

T1105 Ingress Tool Transfer

Malware and tools

Cobalt StrikeMalwareS0154
SocGholishMalwareS1124

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.