Mustard Tempest
IntrusionSet · ATTACK:enterprise:G1020
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1020",
"title": "Mustard Tempest",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1020",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--0d4ac089-ced4-4cc4-a989-174d08e6d030",
"external_id": "G1020",
"domain": "enterprise",
"created": "2023-12-06T19:00:11.581Z",
"modified": "2026-07-31T18:47:37.053Z",
"version": "1.0",
"aliases": [
"Mustard Tempest",
"DEV-0206",
"TA569",
"GOLD PRELUDE",
"UNC1543"
],
"tactics": [
],
"source_references": [
{
"source_name": "DEV-0206"
},
{
"source_name": "TA569"
},
{
"source_name": "GOLD PRELUDE"
},
{
"source_name": "UNC1543"
},
{
"source_name": "SocGholish-update",
"url": "https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Ransomware as a Service",
"url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
},
{
"source_name": "Secureworks Gold Prelude Profile",
"url": "https://www.secureworks.com/research/threat-profiles/gold-prelude"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1583.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04200684-0886-4299-ac13-f2c59c3b47d9
Microsoft Ransomware as a ServiceATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27d95bad-b939-43eb-a683-c3c3367cf728
SentinelOne SocGholish Infrastructure November 2022ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37ad67f8-5b5c-4513-8465-fa584103f25b
SocGholish-update · Red Canary SocGholish March 2024ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fe304c6-4f26-42a9-b1f4-22635fd01245
SocGholish-updateATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63bce642-8e12-44c1-a805-e7390aef23e7
SocGholish-update · SentinelOne SocGholish Infrastructure November 2022 · Red Canary SocGholish March 2024 · Secureworks Gold Prelude ProfileATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1608.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ffd5c6a-da54-43ee-b384-7458499302ad
SocGholish-update · Microsoft Ransomware as a ServiceATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91d541d9-b396-4499-8ed6-f0c762e1d495
SocGholish-update · SentinelOne SocGholish Infrastructure November 2022 · Red Canary SocGholish March 2024 · Secureworks Gold Prelude ProfileATTACK:enterprise:G1020 → uses → ATTACK:enterprise:S1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--944f957c-f44b-4635-9635-985aedbb5d17
SocGholish-update · Microsoft Ransomware as a Service · Secureworks Gold Prelude ProfileATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a255458-7c76-4705-98f1-e2602ebc7795
SocGholish-update · SentinelOne SocGholish Infrastructure November 2022 · Red Canary SocGholish March 2024 · Secureworks Gold Prelude ProfileATTACK:enterprise:G1020 → uses → ATTACK:enterprise:S0154
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d2fbb81-fd66-4d1b-b919-58d251a06dbe
Microsoft Ransomware as a ServiceATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c809e1ba-e97b-41bf-a704-26fe09b6235c
SocGholish-update · Microsoft Ransomware as a ServiceATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e08f461a-7ebb-41e8-8e97-9ade8f52e4e2
Microsoft Ransomware as a ServiceATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1583.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7a7e9ac-e03a-4fd1-b8e1-bc9524abf051
SentinelOne SocGholish Infrastructure November 2022ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeebf544-5120-400b-9e79-d98aa070f905
Microsoft Ransomware as a Service