FORENSIA

THREAT_ACTOR · G1020

Mustard Tempest

Also known as: Mustard Tempest, DEV-0206, TA569, GOLD PRELUDE, UNC1543

Profile

Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools.

MITRE ATT&CK ↗

Techniques

12 ATT&CK techniques attributed to this actor.

T1036.005 Match Legitimate Resource Name or LocationT1082 System Information DiscoveryT1105 Ingress Tool TransferT1189 Drive-by CompromiseT1204.001 Malicious LinkT1566.002 Spearphishing LinkT1583.004 ServerT1583.008 MalvertisingT1584.001 DomainsT1608.001 Upload MalwareT1608.004 Drive-by TargetT1608.006 SEO Poisoning

Software

2 malware/tools attributed to this actor.

Cobalt StrikeSocGholish

Related corpus activity

9,415 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Mustard Tempest.

IndicatorTypeFamilySevSrc
cve-2021-4045cve—851
cve-2026-0740cve—851
cve-2025-11837cve—852
cve-2023-44976cveransomware852
cve-2026-4368cveransomware851
cve-2026-1969cve—851
cve-2026-22584cve—852
cve-2013-3307cve—852
cve-2024-1781cve—851
cve-2026-3102cve—853
cve-2020-22653cve—852
cve-2025-34117cve—851
cve-2013-7471cve—851
cve-2021-29441cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2025-23304cve—852
cve-2021-27076cve—851
cve-2016-15047cve—854
cve-2025-34054cve—854
cve-2018-8007cve—851
cve-2014-2321cve—851
cve-2020-17456cve—851
cve-2022-47945cve—851
cve-2020-22658cve—852
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2016-5681cve—852
cve-2021-25646cve—851
cve-2026-3844cve—851

Showing the top 30 by severity of 9,415.