Mustard Tempest is a threat actor that primarily uses malvertising as their main technique to gain access to and profile networks. They deploy FakeUpdates, disguised as browser updates or software packages, to lure targets into downloading a ZIP file containing a JavaScript file. Once executed, the JavaScript framework acts as a loader for other malware campaigns, often Cobalt Strike payloads. Mustard Tempest has been associated with the cybercrime syndicate Mustard Tempest, also known as EvilCorp, and has been involved in ransomware attacks using payloads such as WastedLocker, PhoenixLocker, and Macaw.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | DEV-0206 |
| OSINT | Purple Vallhund |
| OSINT | TA569 |
| OSINT | GOLD PRELUDE |
| OSINT | UNC1543 |
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names Mustard Tempest, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Mustard Tempest. Each row shows why it was linked and where it came from.
| Type | Indicator | Linked by | Seen | Source |
|---|---|---|---|---|
| domain | ssp-prod.joelbauertraining.com | malware family "FAKEUPDATES" | 2026-10-20 | abuse.ch ThreatFox |
| ip:port | 51.15.16.116:443 | malware family "FAKEUPDATES" | 2024-05-21 | abuse.ch ThreatFox |
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.