Trusted Design

Mustard Tempest

アクターID: G1020

· MITRE Pageへのリンク

脅威アクターの詳細

Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Secureworks Gold Prelude Profile)(Citation: SocGholish-update)

脅威アクターの別名・別称

Mustard Tempest
DEV-0206
TA569
GOLD PRELUDE
UNC1543

利用した攻撃手法

• T1682 - Query Public AI Services
• T1218.013 - Mavinject
• T1543.003 - Windows Service
• T1115 - Clipboard Data
• T1120 - Peripheral Device Discovery
• T1091 - Replication Through Removable Media
• T1557.003 - DHCP Spoofing
• T1059.012 - Hypervisor CLI
• T1543.002 - Systemd Service
• T1547.013 - XDG Autostart Entries
• T1027.018 - Invisible Unicode
• T1053.002 - At

関連するCVE (攻撃手法に関連)

• CVE-2015-0071 (T1027.018)
• CVE-2014-6332 (T1027.018)
• CVE-2012-0158 (T1027.018)
• CVE-2015-2502 (T1027.018)
• CVE-2012-1889 (T1091)
• CVE-2015-2852 (T1027.018)
• CVE-2012-4969 (T1027.018)
• CVE-2012-4792 (T1027.018)
• CVE-2013-2551 (T1027.018)
• CVE-2014-3897 (T1027.018)
• CVE-2012-0611 (T1027.018)
• CVE-2015-2419 (T1027.018)
• CVE-2016-0189 (T1027.018)
• CVE-2015-0310 (T1120)
• CVE-2014-4114 (T1027.018)
• CVE-2015-5119 (T1027.018)
• CVE-2015-5122 (T1027.018)
• CVE-2015-1770 (T1027.018)
• CVE-2012-1856 (T1027.018)
• CVE-2015-2545 (T1027.018)
• CVE-2015-2546 (T1027.018)
• CVE-2017-0199 (T1027.018)
• CVE-2015-3043 (T1027.018)
• CVE-2015-3090 (T1027.018)
• CVE-2015-2590 (T1027.018)
• CVE-2015-2424 (T1027.018)
• CVE-2015-0097 (T1027.018)
• CVE-2014-1761 (T1091)
• CVE-2014-6271 (T1027.018)
• CVE-2014-4113 (T1027.018)
• CVE-2016-1010 (T1027.018)
• CVE-2016-0984 (T1027.018)
• CVE-2016-0998 (T1027.018)
• CVE-2015-1641 (T1027.018)
• CVE-2015-1701 (T1027.018)
• CVE-2015-0313 (T1027.018)
• CVE-2015-0359 (T1027.018)
• CVE-2014-0329 (T1027.018)
• CVE-2015-5130 (T1027.018)
• CVE-2015-5134 (T1027.018)
• CVE-2015-5539 (T1027.018)
• CVE-2015-5557 (T1027.018)
• CVE-2015-5563 (T1027.018)
• CVE-2015-5559 (T1027.018)
• CVE-2015-5540 (T1027.018)
• CVE-2015-5561 (T1027.018)
• CVE-2015-5551 (T1027.018)
• CVE-2015-5564 (T1027.018)
• CVE-2015-5565 (T1027.018)
• CVE-2015-5550 (T1027.018)
• CVE-2015-5566 (T1027.018)
• CVE-2015-5127 (T1027.018)
• CVE-2015-5556 (T1027.018)
• CVE-2015-3628 (T1091)
• CVE-2015-6034 (T1091)
• CVE-2015-2853 (T1027.018)
• CVE-2015-6585 (T1091)
• CVE-2015-6022 (T1027.018)
• CVE-2015-8287 (T1091)
• CVE-2016-2343 (T1091)
• CVE-2017-0263 (T1027.018)
• CVE-2017-0261 (T1027.018)
• CVE-2017-0262 (T1027.018)
• CVE-2016-9494 (T1027.018)
• CVE-2016-9496 (T1027.018)
• CVE-2016-9495 (T1027.018)
• CVE-2025-55182 (T1027.018)
• CVE-2015-0311 (T1027.018)
• CVE-2013-3906 (T1091)
• CVE-2014-6352 (T1091)
• CVE-2015-0016 (T1027.018)
• CVE-2010-3081 (T1091)
• CVE-2010-3333 (T1027.018)
• CVE-2012-3213 (T1027.018)
• CVE-2014-0322 (T1027.018)
• CVE-2015-0336 (T1027.018)
• CVE-2011-3544 (T1027.018)
• CVE-2014-7911 (T1091)
• CVE-2015-3636 (T1091)
• CVE-2013-6282 (T1091)
• CVE-2015-3105 (T1091)
• CVE-2017-16929 (T1027.018)
• CVE-2017-17215 (T1027.018)
• CVE-2013-0074 (T1027.018)
• CVE-2012-0507 (T1027.018)
• CVE-2013-2465 (T1027.018)
• CVE-2010-0188 (T1027.018)
• CVE-2012-4681 (T1027.018)
• CVE-2014-1776 (T1027.018)
• CVE-2014-0556 (T1027.018)
• CVE-2012-1876 (T1027.018)
• CVE-2015-0057 (T1027.018)
• CVE-2012-2539 (T1027.018)
• CVE-2012-1723 (T1027.018)
• CVE-2015-1761 (T1027.018)
• CVE-2014-8440 (T1027.018)
• CVE-2013-3660 (T1027.018)
• CVE-2010-0806 (T1027.018)
• CVE-2013-7331 (T1091)
• CVE-2015-2360 (T1027.018)
• CVE-2014-4148 (T1027.018)
• CVE-2011-3402 (T1027.018)
• CVE-2014-6324 (T1027.018)
• CVE-2014-7247 (T1027.018)
• CVE-2013-2678 (T1027.018)
• CVE-2015-2426 (T1027.018)
• CVE-2008-1436 (T1557.003)
• CVE-2010-0232 (T1027.018)
• CVE-2010-4398 (T1027.018)
• CVE-2012-6422 (T1091)
• CVE-2013-2595 (T1091)
• CVE-2015-4902 (T1027.018)
• CVE-2015-2387 (T1027.018)
• CVE-2009-3129 (T1027.018)
• CVE-2010-2572 (T1027.018)
• CVE-2011-1255 (T1027.018)
• CVE-2011-0611 (T1091)
• CVE-2013-5990 (T1027.018)
• CVE-2017-8570 (T1027.018)
• CVE-2016-4117 (T1091)
• CVE-2017-0001 (T1027.018)
• CVE-2017-0143 (T1027.018)
• CVE-2023-1389 (T1027.018)
• CVE-2025-24893 (T1027.018)
• CVE-2025-31125 (T1027.018)
• CVE-2025-34026 (T1027.018)
• CVE-2025-55183 (T1027.018)
• CVE-2025-55184 (T1027.018)
• CVE-2025-66478 (T1091)
• CVE-2025-68645 (T1027.018)
• CVE-2026-20127 (T1027.018)
• CVE-2016-1287 (T1557.003)
• CVE-2014-3393 (T1557.003)
• CVE-2015-4495 (T1059.012)
• CVE-2015-7645 (T1027.018)
• CVE-2017-12149 (T1027.018)
• CVE-2010-1553 (T1027.018)
• CVE-2013-2094 (T1027.018)
• CVE-2015-8562 (T1027.018)
• CVE-2015-2854 (T1027.018)
• CVE-2016-1898 (T1027.018)
• CVE-2016-1897 (T1027.018)
• CVE-2015-7261 (T1027.018)
• CVE-2015-6036 (T1027.018)
• CVE-2010-1297 (T1027.018)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る