Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Mustard Tempest · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

Mustard Tempest

  • DEV-0206
  • Purple Vallhund
  • TA569
  • GOLD PRELUDE
  • UNC1543

MITRE G1020 ↗

Mustard Tempest — ATT&CK roseMT

attack rose · 12 techniques across 6 tactics

Analyst brief

misp-galaxy + mitre-attack

Mustard Tempest is a threat actor that primarily uses malvertising as their main technique to gain access to and profile networks. They deploy FakeUpdates, disguised as browser updates or software packages, to lure targets into downloading a ZIP file containing a JavaScript file. Once executed, the JavaScript framework acts as a loader for other malware campaigns, often Cobalt Strike payloads. Mustard Tempest has been associated with the cybercrime syndicate Mustard Tempest, also known as EvilCorp, and has been involved in ransomware attacks using payloads such as WastedLocker, PhoenixLocker, and Macaw.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

12 techniques · 6 of 15 tactics

  1. Resource development

    6 techniques

  2. Initial access

    2 techniques

  3. Execution

    1 technique

  4. Stealth

    1 technique

  5. Discovery

    1 technique

  6. Command and control

    1 technique

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
SocGholishS1124 ↗
Cobalt StrikeS0154 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

6 sources
  1. 1.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service…
  2. 2.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-pa…
  3. 3.attack.mitre.org/groups/G1020
  4. 4.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-thr…
  5. 5.learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-th…
  6. 6.secureworks.com/research/threat-profiles/gold-prelude

Track Mustard Tempest on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.