Secureworks Gold Prelude Profile

SocGholish has the ability to enumerate the domain name of a victim, as well as if the host is a member of an Active Directory domain.

The SocGholish JavaScript payload has been delivered within a compressed ZIP archive.

SocGholish can use `whoami` to obtain the username from a compromised host.

SocGholish can list processes on targeted hosts.

The SocGholish payload is executed as JavaScript.

SocGholish has the ability to enumerate system information including the victim computer name.

SocGholish can download additional malware to infected hosts.

Mustard Tempest has used drive-by downloads for initial infection, often using fake browser updates as a lure.

SocGholish can identify the victim's browser in order to serve the correct fake update page.

Mustard Tempest operates a global network of compromised websites that redirect into a traffic distribution system (TDS) to select victims for a fake browser update page.

Mustard Tempest has injected malicious JavaScript into compromised websites to infect victims via drive-by download.

SocGholish can use IP-based geolocation to limit infections to victims in North America, Europe, and a small number of Asian-Pacific nations.