Mustard TempestThreat actor
- dev-0206
- gold prelude
- purple vallhund
- TA569
- unc1543
Mustard Tempest is a threat actor that primarily uses malvertising as their main technique to gain access to and profile networks. They deploy FakeUpdates, disguised as browser updates or software packages, to lure targets into downloading a ZIP file containing a JavaScript file. Once executed, the JavaScript framework acts as a loader for other malware campaigns, often Cobalt Strike payloads.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1195Supply Chain Compromise
“Moreover, the interconnected nature of the financial ecosystem amplifies the risks of supply chain compromises.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Cyber Threat Actors Impacting the Financial Sector in 2024“Some of the most well-documented IABs that are known for targeting financial institutions in their campaigns are TA577, TA569, TA570, Hive0145, Prophet Spider (aka UNC961 aka Gold Melody), among others.”
Indicators in its reports
named in the reports above- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.