Red Canary SocGholish March 2024

SocGholish has the ability to enumerate the domain name of a victim, as well as if the host is a member of an Active Directory domain.

The SocGholish JavaScript payload has been delivered within a compressed ZIP archive.

SocGholish can use `whoami` to obtain the username from a compromised host.

Mustard Tempest has used the filename `AutoUpdater.js` to mimic legitimate update files and has also used the Cyrillic homoglyph characters С `(0xd0a1)` and а `(0xd0b0)`, to produce the filename `Сhrome.Updаte.zip`.

SocGholish can exfiltrate data directly to its C2 domain via HTTP.

The SocGholish payload is executed as JavaScript.

SocGholish can send output from `whoami` to a local temp file using the naming convention `rad<5-hex-chars>.tmp`.

SocGholish has the ability to enumerate system information including the victim computer name.

SocGholish can download additional malware to infected hosts.

Mustard Tempest has used drive-by downloads for initial infection, often using fake browser updates as a lure.

SocGholish can profile compromised systems to identify domain trust relationships.

Mustard Tempest operates a global network of compromised websites that redirect into a traffic distribution system (TDS) to select victims for a fake browser update page.

Mustard Tempest has injected malicious JavaScript into compromised websites to infect victims via drive-by download.