Mustard Tempest Threat Actor Profile: how the SocGholish access broker feeds ransomware

Mustard Tempest does not usually deploy ransomware itself: it builds and sells the first foothold that ransomware crews then use, through fake browser updates served from legitimate websites. MITRE ATT&CK tracks it as G1020, an initial access broker that has operated the SocGholish distribution network since at least 2017, and lists the aliases TA569 (Proofpoint), DEV-0206 (Microsoft's earlier name), GOLD PRELUDE (Secureworks) and UNC1543. This profile looks at the group as a business: how it acquires traffic, how it selects victims, who buys the access and where defenders can break the chain. The malware itself, including its host behaviour and the 2026 law enforcement action against it, is covered in the SocGholish and Fake Browser Update Malware Guide. This page is for SOC leads, threat intelligence analysts, endpoint engineers and website owners.

Key takeaways

• It is an access broker, so the real damage comes later. ATT&CK and Microsoft describe the group gaining and profiling access, then handing it to partners such as Indrik Spider for Cobalt Strike, WastedLocker and LockBit.
• Its infrastructure is other people's websites. Secureworks says compromised sites, often on outdated content management systems, redirect into a traffic distribution system that decides who sees a fake update.
• Victims are filtered for value. Proofpoint and Secureworks describe checks on operating system, referrer, cookies and geolocation, and a command server that prioritises hosts joined to an Active Directory domain.
• The handoff can be fast. Microsoft notes that access broker to ransomware handoffs can take under an hour, and Proofpoint calls TA569's dwell time remarkably low.
• A single policy breaks most of the chain. Microsoft says organisations that make script files open in a text editor by default are largely immune to this lure, even if a user double-clicks the file.

Who they are (names and aliases)

Proofpoint assesses with high confidence that TA569 is a financially motivated actor that monetises access through the exclusive use and sale of SocGholish infections. Microsoft's threat actor naming table lists Mustard Tempest as financially motivated ("Tempest" is Microsoft's family name for that motivation).

Keep the broker and its buyers apart in your tracking. Microsoft places DEV-0243, the activity the industry calls Evil Corp, on the receiving end of DEV-0206 access; Secureworks names GOLD DRAKE as a SocGholish user since at least 2019; Proofpoint says the ransomware seen after SocGholish overlaps with Evil Corp, Gold Drake and UNC2165 without equating TA569 with them. See the Evil Corp Threat Actor Profile Guide.

The business model

Microsoft's 2022 report on the ransomware economy explains where an access broker fits. Brokers sell access to ransomware affiliates, sometimes as a "load", a system prepared to install other malware. Listings that show no antivirus or EDR and a highly privileged credential such as Domain Admin fetch higher prices. Brokers may keep a foothold even after the original weakness is fixed. For the wider market, see the Initial Access Brokers Guide.

Targeting and motivation

• Who is hit: anyone who visits an infected site, filtered down. Secureworks says victims are restricted by IP geolocation to North America, Europe and a small number of Asia-Pacific countries.
• What is valued: domain-joined Windows hosts. Proofpoint says these commonly end in ransomware such as WastedLocker, Hive and LockBit, while non-domain machines usually receive a remote access trojan that may be used to harvest credentials for a later ransomware foothold.
• How traffic arrives: Proofpoint assesses with moderate confidence that the actor does not email infected URLs directly. Infected URLs reach users through ordinary newsletters, marketing email, Google Alerts, search and social media. ATT&CK separately records spearphishing links to compromised sites (T1566.002).
• Who should care: every Windows estate with users who browse, and every organisation that runs a public website, because a compromised site becomes part of the distribution network.

Notable activity

The June 2026 Operation Endgame action against SocGholish infrastructure is summarised, with figures, in the SocGholish and Fake Browser Update Malware Guide. Copycat clusters use the same lure but are not Mustard Tempest; attribute by infrastructure and payload, not by the look of the update page.

Tactics and techniques (MITRE ATT&CK)

These are the ATT&CK v20 techniques recorded against G1020 itself. Techniques recorded against the SocGholish software are listed in the malware guide and not repeated here.

ATT&CK also links the group to SocGholish (S1124) and Cobalt Strike (S0154). See MITRE ATT&CK T1189 Drive-by Compromise and the Malvertising and SEO Poisoning Guide.

How they abuse identities and credentials

• Website administrator and hosting accounts: the distribution network exists because site credentials, plugins or CMS installs were compromised. Site owners should enforce MFA on CMS admin and hosting panels, remove unused admin accounts and audit DNS for subdomains they did not create, the domain shadowing SentinelLabs described.
• The victim's domain identity: what makes a host valuable is that the logged-on user is a domain account. Proofpoint says domain trusts, username and computer name are reported back, so the access is priced on what that identity can reach.
• Privileged credentials raise the price: Microsoft notes that listings with Domain Admin credentials fetch more. Keep admin accounts off daily browsing workstations through tiered administration and privileged access workstations.
• Credentials harvested by follow-on RATs: on non-domain hosts the RAT may be used to gather credentials for later. Treat the user's passwords and sessions as exposed after any SocGholish detection.

Detection and defence

What to monitor

Phased response plan

1. Neutralise the script lure: set the default handler for .js, .jse, .vbs and similar types to Notepad by Group Policy or Intune, pilot with one department, then roll out; rollback is a policy change. Enable the attack surface reduction rule that blocks JavaScript or VBScript from launching downloaded executable content, in audit mode first.
2. Control script hosts: block wscript.exe and cscript.exe for standard users with application control where business scripts allow. See App Control for Business (WDAC).
3. Tell users how updates really arrive: browsers update themselves; a web page asking for an update is a lure to report.
4. Cut the traffic: protective DNS, ad blocking in managed browsers and refreshed network signatures, with browser isolation for links in email where risk justifies it.
5. Treat a detection as a pre-ransomware event: isolate the host, reset the user's credentials and sessions, hunt for remote access tools and Cobalt Strike, and check whether any privileged account was used on the host. Microsoft advises prioritising its "Ransomware-linked emerging threat activity group detected" alerts.
6. Clean your own sites: patch the CMS and plugins, enforce MFA for admins and audit DNS for unknown subdomains.

Decision guidance

• Small organisations: the script handler change and managed browser updates remove most of the risk at almost no cost. Host websites on a managed platform that patches the CMS for you.
• Large organisations: add application control on script hosts, protective DNS, a ransomware-precursor playbook for loader detections and privileged access workstations so that domain admin credentials never meet a browsing session.
• Containment speed: because handoffs can be quick, give the SOC authority to isolate a host on a SocGholish alert without waiting for business approval.

Metrics

• Percentage of Windows endpoints where .js and .vbs open in Notepad by default.
• Number of script host executions from user download folders per month (target falling to near zero).
• Median time from a loader alert to host isolation.
• Percentage of privileged accounts used only from privileged access workstations.
• Number of public websites with an unpatched CMS or plugin, and of CMS admin accounts without MFA.

Framework mapping

Common failure patterns

• Closing the alert after the script is quarantined: by then the host may already have been profiled and handed to a buyer.
• Admins browsing with privileged accounts: a fake update on that session is worth far more to a broker.
• Relying on blocklists alone: SentinelLabs saw the second-stage infrastructure rotate constantly, so indicators age quickly.
• Treating every fake update as SocGholish: copycat clusters such as ClearFake use the same lure with different payloads, so response steps must follow the payload found.
• Ignoring your own website: an unpatched CMS turns your organisation into a distributor for the next victim.

Practitioner checklist

• Track every alias: Mustard Tempest, TA569, DEV-0206, GOLD PRELUDE, UNC1543.
• Make script files open in Notepad by default on all Windows endpoints.
• Audit, then enforce, the ASR rule for JavaScript and VBScript launching downloaded content.
• Alert on script hosts running files from Downloads and on host or domain discovery that follows.
• Deploy protective DNS and keep network signatures current.
• Isolate and reset credentials on any SocGholish detection; hunt for RATs and Cobalt Strike.
• Keep privileged accounts off browsing workstations.
• Patch CMS and plugins, enforce admin MFA and audit DNS for unknown subdomains on your own sites.

Standards and references

• MITRE ATT&CK: Mustard Tempest (G1020)
• Microsoft: Ransomware as a service, understanding the cybercrime gig economy
• Microsoft: How Microsoft names threat actors
• Proofpoint: SocGholish, a very real threat from a very fake update
• Proofpoint: The current landscape of fake browser updates
• Secureworks: GOLD PRELUDE threat profile
• SentinelLabs: SocGholish diversifies and expands its malware staging infrastructure

Related NHI Mgmt Group resources: SocGholish and Fake Browser Update Malware Guide · Initial Access Brokers Guide · Evil Corp Threat Actor Profile Guide · Drive-by Downloads Guide · TA577 Threat Actor Profile