Threat intelligence / Malware

SocGholish

[SocGholish](https://attack.mitre.org/software/S1124) is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily through drive-by-downloads masquerading as software updates. SocGholish is operated by [Mustard Tempest](https://attack.mitre.org/groups/G1020) and its access has been sold to groups including [Indrik Spider](https://attack.mitre.org/groups/G0119) for downloading secondary RAT and ransomware payloads.(Citation: SentinelOne SocGholish Infrastructure November 2022)(Citation: SocGholish-update)(Citation: Red Canary SocGholish March 2024)(Citation: Secureworks Gold Prelude Profile)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SocGholish](https://attack.mitre.org/software/S1124) is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily through drive-by-downloads masquerading as software updates. SocGholish is operated by [Mustard Tempest](https://attack.mitre.org/groups/G1020) and its access has been sold to groups including [Indrik Spider](https://attack.mitre.org/groups/G0119) for downloading secondary RAT and ransomware payloads.(Citation: SentinelOne SocGholish Infrastructure November 2022)(Citation: SocGholish-update)(Citation: Red Canary SocGholish March 2024)(Citation: Secureworks Gold Prelude Profile)

Labels

malware

20 recorded

Relationships

uses

from Mustard Tempest

Group

uses

Technique

uses

to Domain Trust Discovery

Technique

uses

to Drive-by Compromise

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Local Data Staging

Technique

uses

to Malicious Link

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Process Discovery

Technique

uses

to Software Discovery

Technique

uses

to Spearphishing Link

Technique

uses

to System Information Discovery

Technique

uses

to System Location Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

Technique

uses

to Windows Management Instrumentation

Technique

6 external

References

mitre-attack

S1124

FakeUpdates

—

SocGholish-update

https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update

SentinelOne SocGholish Infrastructure November 2022

https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/

Red Canary SocGholish March 2024

https://redcanary.com/threat-detection-report/threats/socgholish/

Secureworks Gold Prelude Profile

https://www.secureworks.com/research/threat-profiles/gold-prelude