H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Group

Mustard Tempest

[Mustard Tempest](https://attack.mitre.org/groups/G1020) is an initial access broker that has operated the [SocGholish](https://attack.mitre.org/software/S1124) distribution network since at least 2017. [Mustard Tempest](https://attack.mitre.org/groups/G1020) has partnered with [Indrik Spider](https://attack.mitre.org/groups/G0119) to provide access for the download of additional malware including LockBit, [WastedLocker](https://attack.mitre.org/software/S0612), and remote access tools.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Secureworks Gold Prelude Profile)(Citation: SocGholish-update)

Group
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Mustard Tempest](https://attack.mitre.org/groups/G1020) is an initial access broker that has operated the [SocGholish](https://attack.mitre.org/software/S1124) distribution network since at least 2017. [Mustard Tempest](https://attack.mitre.org/groups/G1020) has partnered with [Indrik Spider](https://attack.mitre.org/groups/G0119) to provide access for the download of additional malware including LockBit, [WastedLocker](https://attack.mitre.org/software/S0612), and remote access tools.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Secureworks Gold Prelude Profile)(Citation: SocGholish-update)

14 recorded

Relationships

uses
to Cobalt Strike
Malware
uses
to Domains
Technique
uses
to Drive-by Compromise
Technique
uses
to Drive-by Target
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Malicious Link
Technique
uses
to Malvertising
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to SEO Poisoning
Technique
uses
to Server
Technique
uses
to SocGholish
Malware
uses
to Spearphishing Link
Technique
uses
to System Information Discovery
Technique
uses
to Upload Malware
Technique
9 external

References

mitre-attack
G1020
open
DEV-0206
—
TA569
—
GOLD PRELUDE
—
UNC1543
—
SocGholish-update
https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update
open
Microsoft Threat Actor Naming July 2023
https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
open
Microsoft Ransomware as a Service
https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
open
Secureworks Gold Prelude Profile
https://www.secureworks.com/research/threat-profiles/gold-prelude
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance