G10208 cited sources

Mustard Tempest

Also tracked as DEV-0206, TA569, GOLD PRELUDE, UNC1543

Techniques Mapped12

Tools & Malware2

Campaigns TrackedNone published

Last Updated (MITRE)Jul 31, 2026

Description (MITRE ATT&CK)

Mustard Tempest is an initial access broker that has operated the SocGholish distribution network since at least 2017. Mustard Tempest has partnered with Indrik Spider to provide access for the download of additional malware including LockBit, WastedLocker, and remote access tools.

Known Techniques by Tactic

Resource Development (6)

Initial Access (2)

Stealth (1)

Match Legitimate Resource Name or Location

Associated Tools & Malware

SocGholish (malware)Cobalt Strike (malware)

Seraph Context

Organisational Relevance

Shown when this actor's known techniques match your monitored environment.

Exploited CVE Correlation

Surfaced when a technique used by this actor maps to a tracked CISA KEV entry.

Sector & Regional Signal

Derived from MITRE's own published description text, never asserted beyond it.

Watchlist

Signed-in customers can track this actor and be notified of profile updates.

Is this actor relevant to your environment?

Match this actor's known techniques against the technologies you run inside Seraph CTI, and get notified if their profile changes.

Explore Seraph CTI Back to Threat Actors