S1124 SocGholish

malwareEnterprise

platformsWindows

also known asSocGholish · FakeUpdates

SocGholish is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily through drive-by-downloads masquerading as software updates. SocGholish is operated by Mustard Tempest and its access has been sold to groups including Indrik Spider for downloading secondary RAT and ransomware payloads.

techniques used (19)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027.013Encrypted/Encoded File
T1027.015Compression
T1033System Owner/User Discovery
T1036.005Match Legitimate Resource Name or Location
T1047Windows Management Instrumentation
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
T1057Process Discovery
T1059.007JavaScript
T1074.001Local Data Staging
T1082System Information Discovery
T1102Web Service
T1105Ingress Tool Transfer
T1189Drive-by Compromise
T1204.001Malicious Link
T1482Domain Trust Discovery
T1518Software Discovery
T1566.002Spearphishing Link
T1614System Location Discovery

used by groups (1)

Threat groups associated with this.

G1020Mustard Tempest

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan