SocGholish-update

SocGholish has the ability to enumerate the domain name of a victim, as well as if the host is a member of an Active Directory domain.

SocGholish can use `whoami` to obtain the username from a compromised host.

Mustard Tempest has used the filename `AutoUpdater.js` to mimic legitimate update files and has also used the Cyrillic homoglyph characters С `(0xd0a1)` and а `(0xd0b0)`, to produce the filename `Сhrome.Updаte.zip`.

SocGholish has been named `AutoUpdater.js` to mimic legitimate update files.

SocGholish has used WMI calls for script execution and system profiling.

The SocGholish payload is executed as JavaScript.

SocGholish has the ability to enumerate system information including the victim computer name.

Mustard Tempest has used drive-by downloads for initial infection, often using fake browser updates as a lure.

SocGholish has been distributed through compromised websites with malicious content often masquerading as browser updates.

SocGholish has lured victims into interacting with malicious links on compromised websites for execution.

Mustard Tempest has lured users into downloading malware through malicious links in fake advertisements and spearphishing emails.

SocGholish can profile compromised systems to identify domain trust relationships.

Mustard Tempest has sent victims emails containing links to compromised websites.

SocGholish has been spread via emails containing malicious links.

Mustard Tempest operates a global network of compromised websites that redirect into a traffic distribution system (TDS) to select victims for a fake browser update page.

Mustard Tempest has injected malicious JavaScript into compromised websites to infect victims via drive-by download.

Mustard Tempest has poisoned search engine results to return fake software updates in order to distribute malware.