Hunter Strategy
  • Trending Topics
  • Threat Intelligence
  • Contact Us
  • Hunter Website
Sign in Subscribe

TA569

TA569 (Gold Prelude, Mustard Tempest, Purple Vallhund, UNC1543) is the financially motivated actor operating SocGholish, distributing malware through hacked websites with fake browser update prompts since at least 2018.

Surge in Fake Installers and Malvertisement Campaigns
Threat Intelligence

Surge in Fake Installers and Malvertisement Campaigns

Fake installer and malvertising campaigns now span Windows and macOS alike, using trojanized DMG and EXE files, delayed activation, and hardware-gated payloads to harvest browser, keychain, and developer credentials while still installing the expected app.
Read more
William Elchert and Antonio Rivera
Trending Topics
RomCom

Trending Topics

TRENDING TOPICS NOV 26, 2025 Russian RomCom Uses SocGholish to Deliver Mythic
Read more
William Elchert and Antonio Rivera
Trending Topics
ECScape

Trending Topics

ECScape flaw lets ECS containers steal AWS credentials from neighbors. Windows UAC bypass abuses eudcedit.exe for silent elevation. SocGholish, run by TA569 (Gold Prelude, Mustard Tempest, Purple Vallhund, UNC1543), sells access to ransomware crews.
Read more
William Elchert and Antonio Rivera
Hunter Strategy © 2026
Powered by Ghost