Mustard Tempest
- ID
- G1020
- Associated names
- DEV-0206, TA569, GOLD PRELUDE, UNC1543
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools.[1][2][3][4]
Techniques used (12)
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1189 Drive-by Compromise
- T1204.001 Malicious Link
- T1566.002 Spearphishing Link
- T1583.004 Server
- T1583.008 Malvertising
- T1584.001 Domains
- T1608.001 Upload Malware
- T1608.004 Drive-by Target
- T1608.006 SEO Poisoning