Mustard Tempest
Also reported as TA569, GOLD PRELUDE, UNC1543 and DEV-0206.
Reports per quarter
Techniques seen in the last two years
- T1003.001 2 reports reports only
- T1007 2 reports reports only
- T1020 2 reports reports only
- T1021.001 2 reports reports only
- T1027 2 reports reports only
- T1047 2 reports reports only
- T1053.005 2 reports reports only
- T1056.001 2 reports reports only
- T1059.007 2 reports reports only
- T1071 2 reports reports only
Show all 55 techniques Show fewer
- T1098 2 reports reports only
- T1133 2 reports reports only
- T1486 2 reports reports only
- T1588.003 2 reports reports only
- T1608.004 2 reports in ATT&CK
- T1003.002 1 report reports only
- T1006 1 report reports only
- T1016 1 report reports only
- T1021.002 1 report reports only
- T1021.004 1 report reports only
- T1027.013 1 report reports only
- T1041 1 report reports only
- T1059.001 1 report reports only
- T1059.003 1 report reports only
- T1059.006 1 report reports only
- T1069.001 1 report reports only
- T1069.002 1 report reports only
- T1070.004 1 report reports only
- T1071.001 1 report reports only
- T1074.001 1 report reports only
- T1078 1 report reports only
- T1082 1 report in ATT&CK
- T1083 1 report reports only
- T1087.002 1 report reports only
- T1095 1 report reports only
- T1105 1 report in ATT&CK
- T1112 1 report reports only
- T1135 1 report reports only
- T1189 1 report in ATT&CK
- T1201 1 report reports only
- T1204.002 1 report reports only
- T1482 1 report reports only
- T1547.001 1 report reports only
- T1552 1 report reports only
- T1552.001 1 report reports only
- T1555 1 report reports only
- T1555.003 1 report reports only
- T1572 1 report reports only
- T1574.001 1 report reports only
- T1583.001 1 report reports only
- T1583.003 1 report reports only
- T1583.004 1 report in ATT&CK
- T1584.001 1 report in ATT&CK
- T1587.001 1 report reports only
- T1602.002 1 report reports only
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2018-13379 KEV ransomware
- CVE-2019-0604 KEV ransomware
- CVE-2019-11510 KEV ransomware
- CVE-2019-19781 KEV ransomware
- CVE-2020-10189 KEV
- CVE-2020-8243 KEV
- CVE-2020-8260 KEV
- CVE-2021-20016 KEV ransomware
- CVE-2021-22893 KEV ransomware
- CVE-2021-22894 KEV
- CVE-2021-22899 KEV
- CVE-2021-22900 KEV
Show all 30 CVEs Show fewer
- CVE-2021-26855 KEV ransomware
- CVE-2021-26857 KEV ransomware
- CVE-2021-26858 KEV ransomware
- CVE-2021-27065 KEV ransomware
- CVE-2021-30116 KEV ransomware
- CVE-2021-31207 KEV ransomware
- CVE-2021-34473 KEV ransomware
- CVE-2021-34523 KEV ransomware
- CVE-2021-34527 KEV ransomware
- CVE-2021-36942 KEV ransomware
- CVE-2021-40444 KEV ransomware
- CVE-2021-40539 KEV ransomware
- CVE-2021-44077 KEV
- CVE-2021-44228 KEV ransomware
- CVE-2021-44515 KEV
- CVE-2022-30190 KEV ransomware
- CVE-2023-27350 KEV ransomware
- CVE-2026-21236
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor FAKEUPDATES (Malware Family)
-
Indrik Spider - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Indrik Spider - Threat Group Cards: A Threat Actor Encyclopedia
-
Raspberry Robin (Malware Family)
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Raspberry Robin (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Clop (Malware Family)
Show all 67 reports Show fewer
-
The original link failed its last check. Original publisher Detailsfor Untitled
-
Microsoft links Raspberry Robin worm to Clop ransomware attacks
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft links Raspberry Robin worm to Clop ransomware attacks
-
Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity
-
Raspberry Robin and Dridex- Two Birds of a Feather
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Raspberry Robin and Dridex- Two Birds of a Feather
-
Microsoft Links Raspberry Robin USB Worm to Russian Evil Corp Hackers
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Links Raspberry Robin USB Worm to Russian Evil Corp Hackers
-
To HADES and Back- UNC2165 Shifts to LOCKBIT to Evade Sanctions
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor To HADES and Back- UNC2165 Shifts to LOCKBIT to Evade Sanctions
-
Ransomware-as-a-service- Understanding the cybercrime gig economy and how to protect yourself
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Ransomware-as-a-service- Understanding the cybercrime gig economy and how to protect yourself
-
The First Step- Initial Access Leads to Ransomware
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The First Step- Initial Access Leads to Ransomware
Newest first. Details opens the report in Explore.