Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
Also known as: DEV-0206, TA569, GOLD PRELUDE, UNC1543
12
techniques
2
software
10,649
corpus matches
profile
Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools.
techniques
12 attributed · most-instrumented first
software
2 malware & tools attributed
Cobalt Strike
S0154
SocGholish
S1124
read this carefully
10,649 corpus matches is not attribution
That count is indicators which exhibit techniques Mustard Tempest is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
showing 30 of 10,649
known aliases
Vendors name the same group differently. Searching any alias reaches this profile.