@prefix attack: . @prefix attack-res: . @prefix dcterms: . @prefix xsd: . attack-res:attack-pattern--00290ac5-551e-44aa-bbd8-c4b913488a6d a attack:Technique ; dcterms:created "2020-11-04T16:43:31.619000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. On Android and iOS, APIs and libraries exist to facilitate scheduling tasks to execute at a specified date, time, or interval. On Android, the `WorkManager` API allows asynchronous tasks to be scheduled with the system. `WorkManager` was introduced to unify task scheduling on Android, using `JobScheduler`, `GcmNetworkManager`, and `AlarmManager` internally. `WorkManager` offers a lot of flexibility for scheduling, including periodically, one time, or constraint-based (e.g. only when the device is charging).(Citation: Android WorkManager) On iOS, the `NSBackgroundActivityScheduler` API allows asynchronous tasks to be scheduled with the system. The tasks can be scheduled to be repeating or non-repeating, however, the system chooses when the tasks will be executed. The app can choose the interval for repeating tasks, or the delay between scheduling and execution for one-time tasks.(Citation: Apple NSBackgroundActivityScheduler)""" ; dcterms:modified "2025-10-24T17:48:18.936000+00:00"^^xsd:dateTime ; dcterms:title "Scheduled Task/Job" ; dcterms:version "1.0" ; attack:isSubtechnique false . attack-res:attack-pattern--08e22979-d320-48ed-8711-e7bf94aabb13 a attack:Technique ; dcterms:created "2022-04-05T20:11:08.894000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may attempt to position themselves between two or more networked devices to support follow-on behaviors such as [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002) or [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1642). [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1638) can be achieved through several mechanisms. For example, a malicious application may register itself as a VPN client, effectively redirecting device traffic to adversary-owned resources. Registering as a VPN client requires user consent on both Android and iOS; additionally, a special entitlement granted by Apple is needed for iOS devices. Alternatively, a malicious application with escalation privileges may utilize those privileges to gain access to network traffic. Specific to Android devices, adversary-in-the-disk is a type of AiTM attack where adversaries monitor and manipulate data that is exchanged between applications and external storage.(Citation: mitd_kaspersky)(Citation: mitd_checkpoint)(Citation: mitd_checkpoint_research) To accomplish this, a malicious application firsts requests for access to multimedia files on the device (`READ_EXTERNAL STORAGE` and `WRITE_EXTERNAL_STORAGE`), then the application reads data on the device and/or writes malware to the device. Though the request for access is common, when used maliciously, adversaries may access files and other sensitive data due to abusing the permission. Multiple applications were shown to be vulnerable against this attack; however, scrutiny of permissions and input validations may mitigate this attack. Outside of a mobile device, adversaries may be able to capture traffic by employing a rogue base station or Wi-Fi access point. These devices will allow adversaries to capture network traffic after it has left the device, while it is flowing to its destination. On a local network, enterprise techniques could be used, such as [ARP Cache Poisoning](https://attack.mitre.org/techniques/T1557/002) or [DHCP Spoofing](https://attack.mitre.org/techniques/T1557/003). If applications properly encrypt their network traffic, sensitive data may not be accessible to adversaries, depending on the point of capture. For example, properly implementing Apple’s Application Transport Security (ATS) and Android’s Network Security Configuration (NSC) may prevent sensitive data leaks.(Citation: NSC_Android)""" ; dcterms:modified "2025-10-24T17:48:21.401000+00:00"^^xsd:dateTime ; dcterms:title "Adversary-in-the-Middle" ; dcterms:version "2.2" ; attack:isSubtechnique false . attack-res:attack-pattern--08ea902d-ecb5-47ed-a453-2798057bb2d3 a attack:Technique ; dcterms:created "2022-04-01T15:54:05.633000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may circumvent mechanisms designed to control elevated privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can gain on a machine. Authorization has to be granted to specific users in order to perform tasks that are designated as higher risk. An adversary can use several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system. " ; dcterms:modified "2025-10-24T17:48:21.493000+00:00"^^xsd:dateTime ; dcterms:title "Abuse Elevation Control Mechanism" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--0b761f2b-197a-40f2-b100-8152cb957c0c a attack:Technique ; dcterms:created "2023-09-25T19:53:07.406000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use legitimate remote access software, such as `VNC`, `TeamViewer`, `AirDroid`, `AirMirror`, etc., to establish an interactive command and control channel to target mobile devices. Remote access applications may be installed and used post-compromise as an alternate communication channel for redundant access or as a way to establish an interactive remote session with the target device. They may also be used as a component of malware to establish a reverse connection to an adversary-controlled system or service. Installation of remote access tools may also include persistence. """ ; dcterms:modified "2025-04-16T21:21:44.009000+00:00"^^xsd:dateTime ; dcterms:title "Remote Access Software" ; dcterms:version "1.0" ; attack:isSubtechnique false . attack-res:attack-pattern--0cdd66ad-26ac-4338-a764-4972a1e17ee3 a attack:Technique ; dcterms:created "2022-03-30T19:31:31.855000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by: * Abusing device owner permissions to perform silent uninstallation using device owner API calls. * Abusing root permissions to delete files from the filesystem. * Abusing the accessibility service. This requires sending an intent to the system to request uninstallation, and then abusing the accessibility service to click the proper places on the screen to confirm uninstallation.""" ; dcterms:modified "2026-05-12T15:12:00.620000+00:00"^^xsd:dateTime ; dcterms:title "Uninstall Malicious Application" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--0d4e3bbb-7af5-4c88-a215-0c0906bc1e8d a attack:Technique ; dcterms:created "2022-03-30T19:28:25.541000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may delete, alter, or hide generated artifacts on a device, including files, jailbreak status, or the malicious application itself. These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This may compromise the integrity of mobile security solutions by causing notable events or information to go unreported." ; dcterms:modified "2025-10-24T17:48:23.556000+00:00"^^xsd:dateTime ; dcterms:title "Indicator Removal on Host" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--0d95940f-9583-4e0f-824c-a42c1be47fad a attack:Technique ; dcterms:created "2018-10-17T00:14:20.652000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency, specifically with the widespread usage of third-party advertising libraries.(Citation: Grace-Advertisement)(Citation: NowSecure-RemoteCode)""" ; dcterms:modified "2025-10-24T17:48:23.643000+00:00"^^xsd:dateTime ; dcterms:title "Supply Chain Compromise" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--0f4fb01b-d57a-4375-b7a2-342c9d3248f7 a attack:Technique ; dcterms:created "2022-04-05T19:49:58.938000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may exploit the lack of authentication in signaling system network nodes to track the location of mobile devices by impersonating a node.(Citation: Engel-SS7)(Citation: Engel-SS7-2008)(Citation: 3GPP-Security)(Citation: Positive-SS7)(Citation: CSRIC5-WG10-FinalReport) By providing the victim’s MSISDN (phone number) and impersonating network internal nodes to query subscriber information from other nodes, adversaries may use data collected from each hop to eventually determine the device’s geographical cell area or nearest cell tower.(Citation: Engel-SS7)""" ; dcterms:modified "2025-10-24T17:48:24.309000+00:00"^^xsd:dateTime ; dcterms:title "Impersonate SS7 Nodes" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--114fed8b-7eed-4136-8b9c-411c5c7fff4b a attack:Technique ; dcterms:created "2023-07-12T20:45:14.704000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by giving artifacts the name and icon of a legitimate, trusted application (i.e., Settings), or using a package name that matches legitimate, trusted applications (i.e., `com.google.android.gm`). Adversaries may also use the same icon of the file or application they are trying to mimic. """ ; dcterms:modified "2026-05-12T15:12:00.621000+00:00"^^xsd:dateTime ; dcterms:title "Match Legitimate Name or Location" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--11c2c2b7-1fd4-408f-bc2e-fe772ef9df5e a attack:Technique ; dcterms:created "2022-04-01T12:36:41.507000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may utilize standard operating system APIs to collect data from permission-backed data stores on a device, such as the calendar or contact list. These permissions need to be declared ahead of time. On Android, they must be included in the application’s manifest. On iOS, they must be included in the application’s `Info.plist` file. In almost all cases, the user is required to grant access to the data store that the application is trying to access. In recent OS versions, vendors have introduced additional privacy controls for users, such as the ability to grant permission to an application only while the application is being actively used by the user. If the device has been jailbroken or rooted, an adversary may be able to access [Protected User Data](https://attack.mitre.org/techniques/T1636) without the user’s knowledge or approval. """ ; dcterms:modified "2025-10-24T17:48:25.642000+00:00"^^xsd:dateTime ; dcterms:title "Protected User Data" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--16d73b64-5681-4ea0-9af4-4ad86f7c96e8 a attack:Technique ; dcterms:created "2022-04-05T20:15:43.636000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private that should not be distributed. Due to how asymmetric algorithms work, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA, ElGamal, and ECDSA. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1521/002).""" ; dcterms:modified "2026-10-13T14:29:13.671000+00:00"^^xsd:dateTime ; dcterms:title "Asymmetric Cryptography" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--198ce408-1470-45ee-b47f-7056050d4fc2 a attack:Technique ; dcterms:created "2017-10-25T14:48:28.067000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1418) during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions. Adversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications. """ ; dcterms:modified "2026-05-12T15:12:00.622000+00:00"^^xsd:dateTime ; dcterms:title "Software Discovery" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--1b51f5bc-b97a-498a-8dbd-bc6b1901bf19 a attack:Technique ; dcterms:created "2017-10-25T14:48:33.926000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may attempt to get information about running processes on a device. Information obtained could be used to gain an understanding of common software/applications running on devices within a network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1424) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Recent Android security enhancements have made it more difficult to obtain a list of running processes. On Android 7 and later, there is no way for an application to obtain the process list without abusing elevated privileges. This is due to the Android kernel utilizing the `hidepid` mount feature. Prior to Android 7, applications could utilize the `ps` command or examine the `/proc` directory on the device.(Citation: Android-SELinuxChanges) In iOS, applications have previously been able to use the `sysctl` command to obtain a list of running processes. This functionality has been removed in later iOS versions. """ ; dcterms:modified "2025-10-24T17:48:28.244000+00:00"^^xsd:dateTime ; dcterms:title "Process Discovery" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--1d1b1558-c833-482e-aabb-d07ef6eae63d a attack:Technique ; dcterms:created "2022-04-01T13:12:23.522000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may utilize standard operating system APIs to gather call log data. On Android, this can be accomplished using the Call Log Content Provider. iOS provides no standard API to access the call log. If the device has been jailbroken or rooted, an adversary may be able to access the [Call Log](https://attack.mitre.org/techniques/T1636/002) without the user’s knowledge or approval. """ ; dcterms:modified "2026-05-12T15:12:00.622000+00:00"^^xsd:dateTime ; dcterms:title "Call Log" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--1d44f529-6fe6-489f-8a01-6261ac43f05e a attack:Technique ; dcterms:created "2022-03-31T19:50:45.752000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may attempt to get a listing of security applications and configurations that are installed on a device. This may include things such as mobile security products. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1418/001) during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempt specific actions. " ; dcterms:modified "2025-10-24T17:48:29.485000+00:00"^^xsd:dateTime ; dcterms:title "Security Software Discovery" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--1ff89c1b-7615-4fe8-b9cb-63aaf52e6dee a attack:Technique ; dcterms:created "2022-03-30T19:05:17.048000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (e.g., by using `malloc`) then invoking that memory with `PTRACE_SETREGS` to set the register containing the next instruction to execute. Ptrace system call injection can also be done with `PTRACE_POKETEXT`/`PTRACE_POKEDATA`, which copy data to a specific address in the target process's memory (e.g., the current address of the next instruction).(Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) Ptrace system call injection may not be possible when targeting processes with high-privileges, and on some systems those that are non-child processes.(Citation: BH Linux Inject) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.""" ; dcterms:modified "2025-10-24T17:48:30.394000+00:00"^^xsd:dateTime ; dcterms:title "Ptrace System Calls" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--20b0931a-8952-42ca-975f-775bad295f1a a attack:Technique ; dcterms:created "2022-04-01T18:42:22.117000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may span both native defenses as well as supplemental capabilities installed by users or mobile endpoint administrators." ; dcterms:modified "2025-10-24T17:48:30.589000+00:00"^^xsd:dateTime ; dcterms:title "Impair Defenses" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--2204c371-6100-4ae0-82f3-25c07c29772a a attack:Technique ; dcterms:created "2017-10-25T14:48:08.613000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may abuse accessibility features in Android devices to steal sensitive data and to spread malware to other devices. Accessibility features in Android are designed to assist users with disabilities, performing a variety of tasks, such as using Action Blocks to control lightbulbs, and changing the device’s user interface, such as changing the font size and adjusting contract or colors.(Citation: Google_AndroidAcsOverview) One example of how adversaries abuse accessibility features is overlaying an HTML object mimicking a legitimate login screen. The user types their credentials in the overlay HTML object, which is then sent to the adversaries.(Citation: SahinSRLabs_FluBot_Dec2021) Another example is a malicious accessibility feature acting as a keylogger. The keylogger monitors changes on the EditText fields and sends it to the adversaries.(Citation: SahinSRLabs_FluBot_Dec2021) This method of attack is also described in [Keylogging](https://attack.mitre.org/techniques/T1417/001); whereas [Abuse Accessibility Features](https://attack.mitre.org/techniques/T1453) captures the overall abuse of accessibility features. """ ; dcterms:modified "2026-05-12T15:12:00.622000+00:00"^^xsd:dateTime ; dcterms:title "Abuse Accessibility Features" ; dcterms:version "3.0" ; attack:isSubtechnique false . attack-res:attack-pattern--22379609-a99f-4a01-bd7e-70f3e105859d a attack:Technique ; dcterms:created "2017-10-25T14:48:13.259000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may exploit remote services of enterprise servers, workstations, or other resources to gain unauthorized access to internal systems once inside of a network. Adversaries may exploit remote services by taking advantage of a mobile device’s access to an internal enterprise network through local connectivity or through a Virtual Private Network (VPN). Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system. An adversary may need to determine if the remote system is in a vulnerable state, which may be done through [Network Service Scanning](https://attack.mitre.org/techniques/T1423) or other Discovery methods. These look for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources. Depending on the permissions level of the vulnerable remote service, an adversary may achieve [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1404) as a result of lateral movement exploitation as well. """ ; dcterms:modified "2025-10-24T17:48:31.144000+00:00"^^xsd:dateTime ; dcterms:title "Exploitation of Remote Services" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--2282a98b-5049-4f61-9381-55baca7c1add a attack:Technique ; dcterms:created "2022-04-01T19:06:27.177000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may communicate using application layer protocols associated with web protocols traffic to avoid detection/network filtering by blending in with existing traffic. Commands to remote mobile devices, and often the results of those commands, will be embedded within the protocol traffic between the mobile client and server. Web protocols such as HTTP and HTTPS are used for web traffic as well as well as notification services native to mobile messaging services such as Google Cloud Messaging (GCM) and newly, Firebase Cloud Messaging (FCM), (GCM/FCM: two-way communication) and Apple Push Notification Service (APNS; one-way server-to-device). Such notification services leverage HTTP/S via the respective API and are commonly abused on Android and iOS respectively in order blend in with routine device traffic making it difficult for enterprises to inspect. """ ; dcterms:modified "2026-05-12T15:12:00.622000+00:00"^^xsd:dateTime ; dcterms:title "Web Protocols" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--233fe2c0-cb41-4765-b454-e0087597fbce a attack:Technique ; dcterms:created "2022-04-01T15:12:50.740000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources. This can occur through social engineering or URI hijacking and typically requires user action to grant access, such as through a system “Open With” dialogue. Application access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework used to issue tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry through OAuth 2.0 using a variety of authorization protocols. An example of a commonly-used sequence is Microsoft's Authorization Code Grant flow.(Citation: Microsoft Identity Platform Protocols May 2019)(Citation: Microsoft - OAuth Code Authorization flow - June 2019) An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested without requiring user credentials.""" ; dcterms:modified "2025-10-24T17:48:31.876000+00:00"^^xsd:dateTime ; dcterms:title "Steal Application Access Token" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--24a77e53-0751-46fc-b207-99378fb35c08 a attack:Technique ; dcterms:created "2022-04-11T20:05:56.069000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may attempt to avoid detection by hiding malicious behavior from the user. By doing this, an adversary’s modifications would most likely remain installed on the device for longer, allowing the adversary to continue to operate on that device. While there are many ways this can be accomplished, one method is by using the device’s sensors. By utilizing the various motion sensors on a device, such as accelerometer or gyroscope, an application could detect that the device is being interacted with. That way, the application could continue to run while the device is not in use but cease operating while the user is using the device, hiding anything that would indicate malicious activity was ongoing. Accessing the sensors in this way does not require any permissions from the user, so it would be completely transparent.""" ; dcterms:modified "2026-05-12T15:12:00.623000+00:00"^^xsd:dateTime ; dcterms:title "User Evasion" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--27d18e87-8f32-4be1-b456-39b90454360f a attack:Technique ; dcterms:created "2022-03-30T17:51:29.550000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors after checking for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware’s behavior to disengage from the victim or conceal the core functions of the payload. They may also search for VME artifacts before dropping further payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1633) during automated discovery to shape follow-on behaviors. Adversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1633) such as checking for system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. """ ; dcterms:modified "2025-10-24T17:48:32.877000+00:00"^^xsd:dateTime ; dcterms:title "Virtualization/Sandbox Evasion" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--28fdd23d-aee3-4afe-bc3f-5f1f52929258 a attack:Technique ; dcterms:created "2023-09-21T22:16:38.002000+00:00"^^xsd:dateTime ; dcterms:description """An adversary may push an update to a previously benign application to add malicious code. This can be accomplished by pushing an initially benign, functional application to a trusted application store, such as the Google Play Store or the Apple App Store. This allows the adversary to establish a trusted userbase that may grant permissions to the application prior to the introduction of malicious code. Then, an application update could be pushed to introduce malicious code.(Citation: android_app_breaking_bad) This technique could also be accomplished by compromising a developer’s account. This would allow an adversary to take advantage of an existing userbase without having to establish the userbase themselves. """ ; dcterms:modified "2023-09-28T15:36:11.282000+00:00"^^xsd:dateTime ; dcterms:title "Application Versioning" ; dcterms:version "1.0" ; attack:isSubtechnique false . attack-res:attack-pattern--29f1f56c-7b7a-4c14-9e39-59577ea2743c a attack:Technique ; dcterms:created "2022-03-30T13:40:37.259000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, Android is a UNIX-like OS and includes a basic [Unix Shell](https://attack.mitre.org/techniques/T1623/001) that can be accessed via the Android Debug Bridge (ADB) or Java’s `Runtime` package. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0027) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells. """ ; dcterms:modified "2025-10-24T17:48:33.677000+00:00"^^xsd:dateTime ; dcterms:title "Command and Scripting Interpreter" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--2aa78dfd-cb6f-4c70-9408-137cfd96be49 a attack:Technique ; dcterms:created "2022-04-01T18:51:13.963000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may disable security tools to avoid potential detection of their tools and activities. This can take the form of disabling security software, modifying SELinux configuration, or other methods to interfere with security tools scanning or reporting information. This is typically done by abusing device administrator permissions or using system exploits to gain root access to the device to modify protected system files." ; dcterms:modified "2025-10-24T17:48:33.763000+00:00"^^xsd:dateTime ; dcterms:title "Disable or Modify Tools" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--2bb20118-e6c0-41dc-a07c-283ea4dd0fb8 a attack:Technique ; dcterms:created "2020-01-21T15:27:30.182000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may transfer tools or other files from an external system onto a compromised device to facilitate follow-on actions. Files may be copied from an external adversary-controlled system through the command and control channel or through alternate protocols with another tool such as FTP." ; dcterms:modified "2026-05-12T15:12:00.623000+00:00"^^xsd:dateTime ; dcterms:title "Ingress Tool Transfer" ; dcterms:version "2.2" ; attack:isSubtechnique false . attack-res:attack-pattern--2ccc3d39-9598-4d32-9657-42e1c7095d26 a attack:Technique ; dcterms:created "2022-04-05T19:57:15.734000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. This algorithm can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control." ; dcterms:modified "2025-10-24T17:48:34.706000+00:00"^^xsd:dateTime ; dcterms:title "Dynamic Resolution" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--2de38279-043e-47e8-aaad-1b07af6d0790 a attack:Technique ; dcterms:created "2017-10-25T14:48:26.890000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans from the mobile device. This technique may take advantage of the mobile device's access to an internal enterprise network either through local connectivity or through a Virtual Private Network (VPN)." ; dcterms:modified "2025-10-24T17:48:35.175000+00:00"^^xsd:dateTime ; dcterms:title "Network Service Scanning" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--32063d7f-0a39-440d-a4a3-2694488f96cc a attack:Technique ; dcterms:created "2022-04-01T15:43:45.913000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications." ; dcterms:modified "2026-05-12T15:12:00.624000+00:00"^^xsd:dateTime ; dcterms:title "Exfiltration Over C2 Channel" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--337e1136-a6d3-4465-a5c5-fdc658117747 a attack:Technique ; dcterms:created "2025-09-17T14:58:52.520000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may utilize standard operating system APIs to gather account data. On Android, this can be accomplished by using the AccountManager API. For example, adversaries may use the `getAccounts()` method to list all accounts.(Citation: Android_AccountManager_Feb2025) On iOS, this can be accomplished by using the Keychain services. If the device has been jailbroken or rooted, adversaries may be able to access [Accounts](https://attack.mitre.org/techniques/T1636/005) without the users’ knowledge or approval. """ ; dcterms:modified "2026-05-12T15:12:00.624000+00:00"^^xsd:dateTime ; dcterms:title "Accounts" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--351c0927-2fc1-4a2c-ad84-cbbee7eb8172 a attack:Technique ; dcterms:created "2017-10-25T14:48:29.405000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may exploit software vulnerabilities in order to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in an application, service, within the operating system software, or kernel itself to execute adversary-controlled code. Security constructions, such as permission levels, will often hinder access to information and use of certain techniques. Adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. When initially gaining access to a device, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and applications running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user- level permission to root permissions depending on the component that is vulnerable. """ ; dcterms:modified "2025-10-24T17:48:38.088000+00:00"^^xsd:dateTime ; dcterms:title "Exploitation for Privilege Escalation" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--351ddf79-2d3a-41b4-9bef-82ea5d3ccd69 a attack:Technique ; dcterms:created "2021-09-20T13:42:20.824000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication. Several permissions may be used to programmatically control phone calls, including: * `ANSWER_PHONE_CALLS` - Allows the application to answer incoming phone calls(Citation: Android Permissions) * `CALL_PHONE` - Allows the application to initiate a phone call without going through the Dialer interface(Citation: Android Permissions) * `PROCESS_OUTGOING_CALLS` - Allows the application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether(Citation: Android Permissions) * `MANAGE_OWN_CALLS` - Allows a calling application which manages its own calls through the self-managed `ConnectionService` APIs(Citation: Android Permissions) * `BIND_TELECOM_CONNECTION_SERVICE` - Required permission when using a `ConnectionService`(Citation: Android Permissions) * `WRITE_CALL_LOG` - Allows an application to write to the device call log, potentially to hide malicious phone calls(Citation: Android Permissions) When granted some of these permissions, an application can make a phone call without opening the dialer first. However, if an application desires to simply redirect the user to the dialer with a phone number filled in, it can launch an Intent using `Intent.ACTION_DIAL`, which requires no specific permissions. This then requires the user to explicitly initiate the call or use some form of [Input Injection](https://attack.mitre.org/techniques/T1516) to programmatically initiate it.""" ; dcterms:modified "2026-05-12T15:12:00.625000+00:00"^^xsd:dateTime ; dcterms:title "Call Control" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--37047267-3e56-453c-833e-d92b68118120 a attack:Technique ; dcterms:created "2022-04-06T13:22:57.683000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). Adversaries may employ custom or publicly available encoding/compression algorithms (such as base64) or embed data within protocol headers and fields.""" ; dcterms:modified "2026-05-12T15:12:00.626000+00:00"^^xsd:dateTime ; dcterms:title "Exfiltration Over Unencrypted Non-C2 Protocol" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--3775a580-a1d1-46c4-8147-c614a715f2e9 a attack:Technique ; dcterms:created "2022-03-30T14:41:00.672000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to subscribe to events such as receiving an SMS message, device boot completion, or other device activities. An intent is a message passed between Android applications or system components. Applications can register to receive broadcast intents at runtime, which are system-wide intents delivered to each app when certain events happen on the device, such as network changes or the user unlocking the screen. Malicious applications can then trigger certain actions within the app based on which broadcast intent was received. In addition to Android system intents, malicious applications can register for intents broadcasted by other applications. This allows the malware to respond based on actions in other applications. This behavior typically indicates a more intimate knowledge, or potentially the targeting of specific devices, users, or applications. In Android 8 (API level 26), broadcast intent behavior was changed, limiting the implicit intents that applications can register for in the manifest. In most cases, applications that register through the manifest will no longer receive the broadcasts. Now, applications must register context-specific broadcast receivers while the user is actively using the app.(Citation: Android Changes to System Broadcasts) """ ; dcterms:modified "2026-05-12T15:12:00.626000+00:00"^^xsd:dateTime ; dcterms:title "Broadcast Receivers" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--39dd7871-f59b-495f-a9a5-3cb8cc50c9b2 a attack:Technique ; dcterms:created "2019-09-15T15:26:08.183000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may collect data within notifications sent by the operating system or other applications. Notifications may contain sensitive data such as one-time authentication codes sent over SMS, email, or other mediums. In the case of Credential Access, adversaries may attempt to intercept one-time code sent to the device. Adversaries can also dismiss notifications to prevent the user from noticing that the notification has arrived and can trigger action buttons contained within notifications.(Citation: ESET 2FA Bypass) " ; dcterms:modified "2026-05-12T15:12:00.627000+00:00"^^xsd:dateTime ; dcterms:title "Access Notifications" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--3e091a89-a493-4a6c-8e88-d57be19bb98d a attack:Technique ; dcterms:created "2022-04-06T13:19:33.785000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Different protocol channels could also include Web services such as cloud storage. Adversaries may opt to also encrypt and/or obfuscate these alternate channels. """ ; dcterms:modified "2025-10-24T17:48:41.491000+00:00"^^xsd:dateTime ; dcterms:title "Exfiltration Over Alternative Protocol" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--45a5fe76-eda3-4d40-8f22-c186efd6278d a attack:Technique ; dcterms:created "2024-02-20T23:39:08.047000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using `adb shell netstat` for Android.(Citation: adb_commands) Adversaries may use the results and responses from these requests to determine if the mobile devices are capable of communicating with adversary-owned C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.""" ; dcterms:modified "2024-02-20T23:39:08.047000+00:00"^^xsd:dateTime ; dcterms:title "Internet Connection Discovery" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--46d818a5-67fa-4585-a7fc-ecf15376c8d5 a attack:Technique ; dcterms:created "2017-10-25T14:48:31.294000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts are part of the underlying operating system and are not accessible to the user unless the device has been rooted or jailbroken. " ; dcterms:modified "2025-10-24T17:48:43.758000+00:00"^^xsd:dateTime ; dcterms:title "Boot or Logon Initialization Scripts" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--498e7b81-238d-404c-aa5e-332904d63286 a attack:Technique ; dcterms:created "2022-03-30T20:31:16.624000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign. Values an adversary can provide about a target system or environment to use as guardrails may include environment information such as location.(Citation: SWB Exodus March 2019) Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [System Checks](https://attack.mitre.org/techniques/T1633/001). While use of [System Checks](https://attack.mitre.org/techniques/T1633/001) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.""" ; dcterms:modified "2026-05-12T15:12:00.630000+00:00"^^xsd:dateTime ; dcterms:title "Execution Guardrails" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--4c58b7c6-a839-4789-bda9-9de33e4d4512 a attack:Technique ; dcterms:created "2022-04-05T19:48:31.195000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt. The operating system and installed applications often have legitimate needs to prompt the user for sensitive information such as account credentials, bank account information, or Personally Identifiable Information (PII). Compared to traditional PCs, the constrained display size of mobile devices may impair the ability to provide users with contextual information, making users more susceptible to this technique’s use.(Citation: Felt-PhishingOnMobileDevices) There are several approaches adversaries may use to mimic this functionality. Adversaries may impersonate the identity of a legitimate application (e.g. use the same application name and/or icon) and, when installed on the device, may prompt the user for sensitive information.(Citation: eset-finance) Adversaries may also send fake device notifications to the user that may trigger the display of an input prompt when clicked.(Citation: Group IB Gustuff Mar 2019) Additionally, adversaries may display a prompt on top of a running, legitimate application to trick users into entering sensitive information into a malicious application rather than the legitimate application. Typically, adversaries need to know when the targeted application and the individual activity within the targeted application is running in the foreground to display the prompt at the proper time. Adversaries can abuse Android’s accessibility features to determine which application is currently in the foreground.(Citation: ThreatFabric Cerberus) Two known approaches to displaying a prompt include: * Adversaries start a new activity on top of a running legitimate application.(Citation: Felt-PhishingOnMobileDevices)(Citation: Hassell-ExploitingAndroid) Android 10 places new restrictions on the ability for an application to start a new activity on top of another application, which may make it more difficult for adversaries to utilize this technique.(Citation: Android Background) * Adversaries create an application overlay window on top of a running legitimate application. Applications must hold the `SYSTEM_ALERT_WINDOW` permission to create overlay windows. This permission is handled differently than typical Android permissions and, at least under certain conditions, is automatically granted to applications installed from the Google Play Store.(Citation: Cloak and Dagger)(Citation: NowSecure Android Overlay)(Citation: Skycure-Accessibility) The `SYSTEM_ALERT_WINDOW` permission and its associated ability to create application overlay windows are expected to be deprecated in a future release of Android in favor of a new API.(Citation: XDA Bubbles)""" ; dcterms:modified "2026-05-12T15:12:00.630000+00:00"^^xsd:dateTime ; dcterms:title "GUI Input Capture" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--4f14e30b-8b57-4a7b-9093-2c0778ea99cf a attack:Technique ; dcterms:created "2022-03-30T19:53:27.791000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may modify system software binaries to establish persistent access to devices. System software binaries are used by the underlying operating system and users over adb or terminal emulators. Adversaries may make modifications to client software binaries to carry out malicious tasks when those binaries are executed. For example, malware may come with a pre-compiled malicious binary intended to overwrite the genuine one on the device. Since these binaries may be routinely executed by the system or user, the adversary can leverage this for persistent access to the device. """ ; dcterms:modified "2025-10-24T17:48:45.611000+00:00"^^xsd:dateTime ; dcterms:title "Compromise Client Software Binary" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--51636761-2e35-44bf-9e56-e337adf97174 a attack:Technique ; dcterms:created "2022-03-30T19:20:37.864000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may perform software packing to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Utilities used to perform software packing are called packers. An example packer is FTT. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.""" ; dcterms:modified "2026-05-12T15:12:00.632000+00:00"^^xsd:dateTime ; dcterms:title "Software Packing" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--52eff1c7-dd30-4121-b762-24ae6fa61bbb a attack:Technique ; dcterms:created "2020-04-28T14:35:37.309000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use Android’s Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions. Like system calls on a traditional desktop operating system, native code achieves execution on a lower level than normal Android SDK calls. The NDK allows developers to write native code in C or C++ that is compiled directly to machine code, avoiding all intermediate languages and steps in compilation that higher level languages, like Java, typically have. The Java Native Interface (JNI) is the component that allows Java functions in the Android app to call functions in a native library.(Citation: Google NDK Getting Started) Adversaries may also choose to use native functions to execute malicious code since native actions are typically much more difficult to analyze than standard, non-native behaviors.(Citation: MITRE App Vetting Effectiveness)""" ; dcterms:modified "2026-05-12T15:12:00.633000+00:00"^^xsd:dateTime ; dcterms:title "Native API" ; dcterms:version "2.0" ; attack:isSubtechnique false . attack-res:attack-pattern--53263a67-075e-48fa-974b-91c5b5445db7 a attack:Technique ; dcterms:created "2018-10-17T00:14:20.652000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may direct victims to download malicious applications via ways that avoid an authorized application store (e.g. Google Play Store or Apple App Store). For example, victims may be directed to downloading a malicious APK directly from a domain. Adversaries may wish to avoid placing malicious applications in an authorized application store due to increased potential risk of detection or other reasons. Delivery methods for malicious applications include: * Spearphishing Attachment: including the mobile application package as an attachment to an email * Spearphishing Link: including a link to the mobile application package within an email, text message (e.g. SMS, iMessage, WhatsApp, etc.), web site, QR code, or other means. * Third-Party Application Store: installing the mobile application package from a third-party application store, as opposed to an authorized app store that the device implicitly trusts as part of its default behavior. Third-party application stores may not apply the same level of scrutiny to applications as enforced by an authorized application store.(Citation: IBTimes-ThirdParty)(Citation: TrendMicro-RootingMalware)(Citation: TrendMicro-FlappyBird) Some Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.(Citation: android-trojan-steals-paypal-2fa)""" ; dcterms:modified "2026-09-03T14:38:12.546000+00:00"^^xsd:dateTime ; dcterms:title "Deliver Malicious Application via Other Means" ; dcterms:version "2.0" ; attack:isSubtechnique false . attack-res:attack-pattern--5abfc5e6-3c56-49e7-ad72-502d01acf28b a attack:Technique ; dcterms:created "2023-08-23T22:13:27.313000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to insecure coding practices that can lead to unanticipated behavior. Adversaries may take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility. Adversaries may use device-based zero-click exploits for code execution. These exploits are powerful because there is no user interaction required for code execution. ### SMS/iMessage Delivery SMS and iMessage in iOS are common targets through [Drive-By Compromise](https://attack.mitre.org/techniques/T1456), [Phishing](https://attack.mitre.org/techniques/T1660), etc. Adversaries may use embed malicious links, files, etc. in SMS messages or iMessages. Mobile devices may be compromised through one-click exploits, where the victim must interact with a text message, or zero-click exploits, where no user interaction is required. ### AirDrop Unique to iOS, AirDrop is a network protocol that allows iOS users to transfer files between iOS devices. Before patches from Apple were released, on iOS 13.4 and earlier, adversaries may force the Apple Wireless Direct Link (AWDL) interface to activate, then exploit a buffer overflow to gain access to the device and run as root without interaction from the user. """ ; dcterms:modified "2023-09-28T17:02:58.893000+00:00"^^xsd:dateTime ; dcterms:title "Exploitation for Client Execution" ; dcterms:version "1.0" ; attack:isSubtechnique false . attack-res:attack-pattern--5ca3c7ec-55b2-4587-9376-cf6c96f8047a a attack:Technique ; dcterms:created "2020-11-30T14:26:07.728000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use a compromised device as a proxy server to the Internet. By utilizing a proxy, adversaries hide the true IP address of their C2 server and associated infrastructure from the destination of the network traffic. This masquerades an adversary’s traffic as legitimate traffic originating from the compromised device, which can evade IP-based restrictions and alerts on certain services, such as bank accounts and social media websites.(Citation: Threat Fabric Exobot) The most common type of proxy is a SOCKS proxy. It can typically be implemented using standard OS-level APIs and 3rd party libraries with no indication to the user. On Android, adversaries can use the `Proxy` API to programmatically establish a SOCKS proxy connection, or lower-level APIs to interact directly with raw sockets.""" ; dcterms:modified "2025-10-24T17:48:50.301000+00:00"^^xsd:dateTime ; dcterms:title "Proxy Through Victim" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--648f8051-1a35-46d3-b1d8-3a3f5cf2cc8e a attack:Technique ; dcterms:created "2019-11-19T17:32:20.373000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may abuse Android's `startForeground()` API method to maintain continuous sensor access. Beginning in Android 9, idle applications running in the background no longer have access to device sensors, such as the camera, microphone, and gyroscope.(Citation: Android-SensorsOverview) Applications can retain sensor access by running in the foreground, using Android’s `startForeground()` API method. This informs the system that the user is actively interacting with the application, and it should not be killed. The only requirement to start a foreground service is showing a persistent notification to the user.(Citation: Android-ForegroundServices) Malicious applications may abuse the `startForeground()` API method to continue running in the foreground, while presenting a notification to the user pretending to be a genuine application. This would allow unhindered access to the device’s sensors, assuming permission has been previously granted.(Citation: BlackHat Sutter Android Foreground 2019) Malicious applications may also abuse the `startForeground()` API to inform the Android system that the user is actively interacting with the application, thus preventing it from being killed by the low memory killer.(Citation: TrendMicro-Yellow Camera)""" ; dcterms:modified "2026-05-12T15:12:00.636000+00:00"^^xsd:dateTime ; dcterms:title "Foreground Persistence" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--667e5707-3843-4da8-bd34-88b922526f0d a attack:Technique ; dcterms:created "2017-10-25T14:48:23.233000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may move onto devices by exploiting or copying malware to devices connected via USB. In the case of Lateral Movement, adversaries may utilize the physical connection of a device to a compromised or malicious charging station or PC to bypass application store requirements and install malicious applications directly.(Citation: Lau-Mactans) In the case of Initial Access, adversaries may attempt to exploit the device via the connection to gain access to data stored on the device.(Citation: Krebs-JuiceJacking) Examples of this include: * Exploiting insecure bootloaders in a Nexus 6 or 6P device over USB and gaining the ability to perform actions including intercepting phone calls, intercepting network traffic, and obtaining the device physical location.(Citation: IBM-NexusUSB) * Exploiting weakly-enforced security boundaries in Android devices such as the Google Pixel 2 over USB.(Citation: GoogleProjectZero-OATmeal) * Products from Cellebrite and Grayshift purportedly that can exploit some iOS devices using physical access to the data port to unlock the passcode.(Citation: Computerworld-iPhoneCracking) """ ; dcterms:modified "2024-11-17T13:26:29.167000+00:00"^^xsd:dateTime ; dcterms:title "Replication Through Removable Media" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--6683aa0c-d98a-4f5b-ac57-ca7e9934a760 a attack:Technique ; dcterms:created "2017-10-25T14:48:12.913000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information. Android and iOS, by default, require that applications request device microphone access from the user. On Android devices, applications must hold the `RECORD_AUDIO` permission to access the microphone or the `CAPTURE_AUDIO_OUTPUT` permission to access audio output. Because Android does not allow third-party applications to hold the `CAPTURE_AUDIO_OUTPUT` permission by default, only privileged applications, such as those distributed by Google or the device vendor, can access audio output.(Citation: Android Permissions) However, adversaries may be able to gain this access after successfully elevating their privileges. With the `CAPTURE_AUDIO_OUTPUT` permission, adversaries may pass the `MediaRecorder.AudioSource.VOICE_CALL` constant to `MediaRecorder.setAudioOutput`, allowing capture of both voice call uplink and downlink.(Citation: Manifest.permission) On iOS devices, applications must include the `NSMicrophoneUsageDescription` key in their `Info.plist` file to access the microphone.(Citation: Requesting Auth-Media Capture)""" ; dcterms:modified "2026-05-12T15:12:00.637000+00:00"^^xsd:dateTime ; dcterms:title "Audio Capture" ; dcterms:version "3.1" ; attack:isSubtechnique false . attack-res:attack-pattern--670a4d75-103b-4b14-8a9e-4652fa795edd a attack:Technique ; dcterms:created "2022-03-30T14:49:18.650000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may execute their own malicious payloads by hijacking the way operating systems run applications. Hijacking execution flow can be for the purposes of persistence since this hijacked execution may reoccur over time. There are many ways an adversary may hijack the flow of execution. A primary way is by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs or resources, such as file directories, could also be poisoned to include malicious payloads.""" ; dcterms:modified "2025-10-24T17:48:53.101000+00:00"^^xsd:dateTime ; dcterms:title "Hijack Execution Flow" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--693cdbff-ea73-49c6-ac3f-91e7285c31d1 a attack:Technique ; dcterms:created "2022-03-30T13:59:50.479000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the underlying command prompts on Android and iOS devices. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges that are only accessible if the device has been rooted or jailbroken. Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. If the device has been rooted or jailbroken, adversaries may locate and invoke a superuser binary to elevate their privileges and interact with the system as the root user. This dangerous level of permissions allows the adversary to run special commands and modify protected system files. """ ; dcterms:modified "2025-10-24T17:48:54.078000+00:00"^^xsd:dateTime ; dcterms:title "Unix Shell" ; dcterms:version "1.2" ; attack:isSubtechnique true . attack-res:attack-pattern--6a3f6490-9c44-40de-b059-e5940f246673 a attack:Technique ; dcterms:created "2017-10-25T14:48:33.158000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the mobile device, and often the results of those commands, will be embedded within the protocol traffic between the mobile device and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS.""" ; dcterms:modified "2025-10-24T17:48:54.576000+00:00"^^xsd:dateTime ; dcterms:title "Application Layer Protocol" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--6c49d50f-494d-4150-b774-a655022d20a6 a attack:Technique ; dcterms:created "2017-10-25T14:48:14.460000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and pre-publication scans in official app stores. In some cases, more advanced dynamic or behavioral analysis techniques could detect this behavior. However, in conjunction with [Execution Guardrails](https://attack.mitre.org/techniques/T1627) techniques, detecting malicious code downloaded after installation could be difficult. On Android, dynamic code could include native code, Dalvik code, or JavaScript code that utilizes Android WebView’s `JavascriptInterface` capability. On iOS, dynamic code could be downloaded and executed through 3rd party libraries such as JSPatch. (Citation: FireEye-JSPatch) """ ; dcterms:modified "2026-05-12T15:12:00.640000+00:00"^^xsd:dateTime ; dcterms:title "Download New Code at Runtime" ; dcterms:version "1.5" ; attack:isSubtechnique false . attack-res:attack-pattern--6ecbc2eb-e85a-440a-ab68-4d98f8d56fbe a attack:Technique ; dcterms:created "2023-12-05T22:14:54.813000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may exploit software vulnerabilities to gain initial access to a mobile device. This can be accomplished in a variety of ways. Vulnerabilities may be present in the applications, the services, the underlying operating system, or the kernel itself. Several well-known mobile device exploits exist, including FORCEDENTRY, StageFright, and BlueBorne. Furthermore, some exploits may be possible to exploit without any user interaction (i.e. zero-click exploits, see [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1658)), making them particularly dangerous. Mobile operating system vendors are typically very quick to patch such critical bugs, ensuring only a small window where they can be exploited. """ ; dcterms:modified "2025-02-27T22:56:19.681000+00:00"^^xsd:dateTime ; dcterms:title "Exploitation for Initial Access" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--6ffad4be-bfe0-424f-abde-4d9a84a800ad a attack:Technique ; dcterms:created "2022-03-30T17:53:35.582000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behavior after checking for the presence of artifacts indicative of a virtual environment or sandbox. If the adversary detects a virtual environment, they may alter their malware’s behavior to disengage from the victim or conceal the core functions of the implant. They may also search for virtualization artifacts before dropping secondary or additional payloads. Checks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. Hardware checks, such as the presence of motion sensors, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices. """ ; dcterms:modified "2025-10-24T17:48:56.336000+00:00"^^xsd:dateTime ; dcterms:title "System Checks" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--702055ac-4e54-4ae9-9527-e23a38e0b160 a attack:Technique ; dcterms:created "2017-10-25T14:48:15.402000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may try to access and collect application data resident on the device. Adversaries often target popular applications, such as Facebook, WeChat, and Gmail.(Citation: SWB Exodus March 2019) Due to mobile OS sandboxing, this technique is only possible in three scenarios: * An application stores files in unprotected external storage * An application stores files in its internal storage directory with insecure permissions (e.g. 777) * The adversary gains root permissions on the device """ ; dcterms:modified "2026-05-12T15:12:00.641000+00:00"^^xsd:dateTime ; dcterms:title "Stored Application Data" ; dcterms:version "3.1" ; attack:isSubtechnique false . attack-res:attack-pattern--73c26732-6422-4081-8b63-6d0ae93d449e a attack:Technique ; dcterms:created "2019-08-08T18:34:14.178000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may use screen capture to collect additional information about a target device, such as applications running in the foreground, user data, credentials, or other sensitive information. Applications running in the background can capture screenshots or videos of another application running in the foreground by using the Android `MediaProjectionManager` (generally requires the device user to grant consent).(Citation: Fortinet screencap July 2019)(Citation: Android ScreenCap1 2019) Background applications can also use Android accessibility services to capture screen contents being displayed by a foreground application.(Citation: Lookout-Monokle) An adversary with root access or Android Debug Bridge (adb) access could call the Android `screencap` or `screenrecord` commands.(Citation: Android ScreenCap2 2019)(Citation: Trend Micro ScreenCap July 2015) " ; dcterms:modified "2026-05-12T15:12:00.642000+00:00"^^xsd:dateTime ; dcterms:title "Screen Capture" ; dcterms:version "1.3" ; attack:isSubtechnique false . attack-res:attack-pattern--74e6003f-c7f4-4047-983b-708cc19b96b6 a attack:Technique ; dcterms:created "2022-04-06T13:39:39.779000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity. By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, or decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity to deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system, typically gained through a prolonged information gathering campaign, in order to have the desired impact. One method to achieve [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1641/001) is by modifying the contents of the device clipboard. Malicious applications may monitor clipboard activity through the `ClipboardManager.OnPrimaryClipChangedListener` interface on Android to determine when clipboard contents have changed. Listening to clipboard activity, reading clipboard contents, and modifying clipboard contents requires no explicit application permissions and can be performed by applications running in the background. However, this behavior has changed with the release of Android 10. Adversaries may use [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1641/001) to replace text prior to being pasted. For example, replacing a copied Bitcoin wallet address with a wallet address that is under adversarial control. [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1641/001) was seen within the Android/Clipper.C trojan. This sample was detected by ESET in an application distributed through the Google Play Store targeting cryptocurrency wallet numbers.(Citation: ESET Clipboard Modification February 2019)""" ; dcterms:modified "2025-10-24T17:48:57.794000+00:00"^^xsd:dateTime ; dcterms:title "Transmitted Data Manipulation" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--7827ced0-95e7-4d05-bdcf-0d8f2d37a3d3 a attack:Technique ; dcterms:created "2022-03-28T19:31:51.978000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Grace-Advertisement)" ; dcterms:modified "2025-10-24T17:48:58.857000+00:00"^^xsd:dateTime ; dcterms:title "Compromise Software Dependencies and Development Tools" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--789ef15a-34d9-4b32-a779-8cbbc9eb32f5 a attack:Technique ; dcterms:created "2022-04-01T15:15:35.640000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data. Applications regularly register URIs with the operating system to act as a response handler for various actions, such as logging into an app using an external account via single sign-on. This allows redirections to that specific URI to be intercepted by the application. If an adversary were to register for a URI that was already in use by a genuine application, the adversary may be able to intercept data intended for the genuine application or perform a phishing attack against the genuine application. Intercepted data may include OAuth authorization codes or tokens that could be used by the adversary to gain access to protected resources.(Citation: Trend Micro iOS URL Hijacking)(Citation: IETF-PKCE) """ ; dcterms:modified "2025-10-24T17:48:59.057000+00:00"^^xsd:dateTime ; dcterms:title "URI Hijacking" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--79cb02f4-ac4e-4335-8b51-425c9573cce1 a attack:Technique ; dcterms:created "2022-03-30T18:05:46.795000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted applications. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features include: an app being allowed to run because it is signed by a valid code signing certificate; an OS prompt alerting the user that an app came from an untrusted source; or getting an indication that you are about to connect to an untrusted site. The method adversaries use will depend on the specific mechanism they seek to subvert. " ; dcterms:modified "2025-10-24T17:48:59.522000+00:00"^^xsd:dateTime ; dcterms:title "Subvert Trust Controls" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--8605a0ec-b44a-4e98-a7fc-87d4bd3acb66 a attack:Technique ; dcterms:created "2022-04-01T15:01:32.169000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may collect keychain data from an iOS device to acquire credentials. Keychains are the built-in way for iOS to keep track of users' passwords and credentials for many services and features such as Wi-Fi passwords, websites, secure notes, certificates, private keys, and VPN credentials. On the device, the keychain database is stored outside of application sandboxes to prevent unauthorized access to the raw data. Standard iOS APIs allow applications access to their own keychain contained within the database. By utilizing a privilege escalation exploit or existing root access, adversaries can access the entire encrypted database.(Citation: Apple Keychain Services)(Citation: Elcomsoft Decrypt Keychain) """ ; dcterms:modified "2025-10-24T17:49:03.949000+00:00"^^xsd:dateTime ; dcterms:title "Keychain" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--8e097ec5-1755-41d6-807c-3882442b818a a attack:Technique ; dcterms:created "2025-03-14T17:56:26.095000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection. Android uses sandboxes to separate resources and code execution between applications and the operating system.(Citation: Android Application Sandbox) There are a few virtualization solutions available on Android, such as the Android Virtualization Framework (AVF).(Citation: Android AVF Overview) Through virtualization solutions, adversaries may execute malicious operations without user knowledge. For example, adversaries may mimic a legitimate banking application’s functionalities in a virtual environment, thanks to the virtualization solution, while malicious code captures credentials. """ ; dcterms:modified "2025-03-14T17:56:26.095000+00:00"^^xsd:dateTime ; dcterms:title "Virtualization Solution" ; dcterms:version "1.0" ; attack:isSubtechnique false . attack-res:attack-pattern--939808a7-121d-467a-b028-4441ee8b7cee a attack:Technique ; dcterms:created "2022-04-06T15:47:06.071000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use an existing, legitimate external Web service channel as a means for sending commands to and receiving output from a compromised system. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media, acting as a mechanism for C2, may give a significant amount of cover. This is due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. """ ; dcterms:modified "2026-05-12T15:12:00.706000+00:00"^^xsd:dateTime ; dcterms:title "Bidirectional Communication" ; dcterms:version "1.2" ; attack:isSubtechnique true . attack-res:attack-pattern--948a447c-d783-4ba0-8516-a64140fcacd5 a attack:Technique ; dcterms:created "2019-08-01T13:44:09.368000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may generate network traffic using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data." ; dcterms:modified "2025-10-24T17:49:07.116000+00:00"^^xsd:dateTime ; dcterms:title "Non-Standard Port" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--9558a84e-2d5e-4872-918e-d847494a8ffc a attack:Technique ; dcterms:created "2022-03-28T19:25:17.596000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version." ; dcterms:modified "2025-10-24T17:49:07.487000+00:00"^^xsd:dateTime ; dcterms:title "Compromise Software Supply Chain" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--986f80f7-ff0e-4f48-87bd-0394814bbce5 a attack:Technique ; dcterms:created "2022-04-06T15:41:03.914000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media, acting as a mechanism for C2, may give a significant amount of cover. This is due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis, or enable operational resiliency (since this infrastructure may be dynamically changed). """ ; dcterms:modified "2025-10-24T17:49:07.948000+00:00"^^xsd:dateTime ; dcterms:title "Dead Drop Resolver" ; dcterms:version "1.2" ; attack:isSubtechnique true . attack-res:attack-pattern--99e6295e-741b-4857-b6e5-64989eb039b4 a attack:Technique ; dcterms:created "2017-10-25T14:48:12.267000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may track a device’s physical location through use of standard operating system APIs via malicious or exploited applications on the compromised device. On Android, applications holding the `ACCESS_COAURSE_LOCATION` or `ACCESS_FINE_LOCATION` permissions provide access to the device’s physical location. On Android 10 and up, declaration of the `ACCESS_BACKGROUND_LOCATION` permission in an application’s manifest will allow applications to request location access even when the application is running in the background.(Citation: Android Request Location Permissions) Some adversaries have utilized integration of Baidu map services to retrieve geographical location once the location access permissions had been obtained.(Citation: PaloAlto-SpyDealer)(Citation: Palo Alto HenBox) On iOS, applications must include the `NSLocationWhenInUseUsageDescription`, `NSLocationAlwaysAndWhenInUseUsageDescription`, and/or `NSLocationAlwaysUsageDescription` keys in their `Info.plist` file depending on the extent of requested access to location information.(Citation: Apple Requesting Authorization for Location Services) On iOS 8.0 and up, applications call `requestWhenInUseAuthorization()` to request access to location information when the application is in use or `requestAlwaysAuthorization()` to request access to location information regardless of whether the application is in use. With elevated privileges, an adversary may be able to access location data without explicit user consent with the `com.apple.locationd.preauthorized` entitlement key.(Citation: Google Project Zero Insomnia)""" ; dcterms:modified "2026-05-12T15:12:00.706000+00:00"^^xsd:dateTime ; dcterms:title "Location Tracking" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--9c049d7b-c92a-4733-9381-27e2bd2ccadc a attack:Technique ; dcterms:created "2022-04-01T15:59:05.830000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may abuse Android’s device administration API to obtain a higher degree of control over the device. By abusing the API, adversaries can perform several nefarious actions, such as resetting the device’s password for [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1642), factory resetting the device for [File Deletion](https://attack.mitre.org/techniques/T1630/002) and to delete any traces of the malware, disabling all the device’s cameras, or to make it more difficult to uninstall the app. Device administrators must be approved by the user at runtime, with a system popup showing which actions have been requested by the app. In conjunction with other techniques, such as [Input Injection](https://attack.mitre.org/techniques/T1516), an app can programmatically grant itself administrator permissions without any user input.""" ; dcterms:modified "2026-05-12T15:12:00.706000+00:00"^^xsd:dateTime ; dcterms:title "Device Administrator Permissions" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--9ef05e3d-52db-4c12-be4f-519214bbe91f a attack:Technique ; dcterms:created "2022-04-05T19:37:15.984000+00:00"^^xsd:dateTime ; dcterms:description "An adversary may use access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an enterprise mobility management (EMM)/mobile device management (MDM) server console to track the location of mobile devices managed by the service.(Citation: Krebs-Location) " ; dcterms:modified "2025-10-24T17:49:09.660000+00:00"^^xsd:dateTime ; dcterms:title "Remote Device Management Services" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--9ef14445-6f35-4ed0-a042-5024f13a9242 a attack:Technique ; dcterms:created "2023-09-22T19:09:15.698000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may destroy data and files on specific devices or in large numbers to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. To achieve data destruction, adversaries may use the `pm uninstall` command to uninstall packages or the `rm` command to remove specific files. For example, adversaries may first use `pm uninstall` to uninstall non-system apps, and then use `rm (-f) ` to delete specific files, further hiding malicious activity.(Citation: rootnik_rooting_tool)(Citation: abuse_native_linux_tools)""" ; dcterms:modified "2026-05-12T15:12:00.706000+00:00"^^xsd:dateTime ; dcterms:title "Data Destruction" ; dcterms:version "1.0" ; attack:isSubtechnique false . attack-res:attack-pattern--a126c117-54e4-4b93-9e4f-72cc964e6760 a attack:Technique ; dcterms:created "2025-05-19T18:24:54.985000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may abuse the “linked devices” feature on messaging applications, such as Signal and WhatsApp, to register the user’s account to an adversary-controlled device. By abusing the “linked devices” feature, adversaries may achieve and maintain persistence through the user’s account, may collect information, such as the user’s messages and contacts list, and may send future messages from the linked device. Signal is a messaging application that uses the open-source Signal Protocol to encrypt messages and calls; similarly, WhatsApp is a messaging application that has end-to-end encryption and other security measures to protect messages and calls. Both applications have a “linked devices” feature that allows users to access their Signal and/or WhatsApp accounts from different devices, such as a Windows or Mac desktop, an iPad or an Android tablet.(Citation: WhatsApp_LinkDevice_NoDate)(Citation: Signal_LinkedDevices_NoDate) Adversaries may use [Phishing](https://attack.mitre.org/techniques/T1660) techniques to trick the user into scanning a quick-response (QR) code, which is used to link the user’s Signal and/or WhatsApp account to an adversary-controlled device. For example, adversaries may masquerade QR codes as group invites, security alerts or as legitimate instructions for pairing linked devices. Upon scanning the QR code in Signal, users may click on the “Transfer Message History” option to sync the linked devices, which may allow adversaries to collect more information about the user. Upon scanning the QR code in WhatsApp, the user’s device will automatically send an end-to-end encrypted copy of recent message history to the adversary-controlled device. """ ; dcterms:modified "2025-05-19T20:03:02.656000+00:00"^^xsd:dateTime ; dcterms:title "Linked Devices" ; dcterms:version "1.0" ; attack:isSubtechnique false . attack-res:attack-pattern--a64a820a-cb21-471f-920c-506a2ff04fa5 a attack:Technique ; dcterms:created "2017-10-25T14:48:20.329000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may gain access to mobile devices through transfers or swaps from victims’ phone numbers to adversary-controlled SIM cards and mobile devices.(Citation: ATT SIM Swap Scams)(Citation: Verizon SIM Swapping) The typical process is as follows: 1. Adversaries will first gather information about victims through [Phishing](https://attack.mitre.org/techniques/T1660), social engineering, data breaches, or other avenues. 2. Adversaries will then impersonate victims as they contact mobile carriers to request for the SIM swaps. For example, adversaries would provide victims’ name and address to mobile carriers; once authenticated, adversaries would request for victims’ phone numbers to be transferred to adversary-controlled SIM cards. 3. Once completed, victims will lose mobile data, such as text messages and phone calls, on their mobile devices. In turn, adversaries will receive mobile data that was intended for the victims. Adversaries may use the intercepted SMS messages to log into online accounts that use SMS-based authentication. Specifically, adversaries may use SMS-based authentication to log into banking and/or cryptocurrency accounts, then transfer funds to adversary-controlled wallets. """ ; dcterms:modified "2025-02-12T16:26:38.632000+00:00"^^xsd:dateTime ; dcterms:title "SIM Card Swap" ; dcterms:version "2.0" ; attack:isSubtechnique false . attack-res:attack-pattern--a8c31121-852b-46bd-9ba4-674ae5afe7ad a attack:Technique ; dcterms:created "2017-10-25T14:48:27.660000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal device usage, users often provide credentials to various locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Keylogging](https://attack.mitre.org/techniques/T1417/001)) or rely on deceiving the user into providing input into what they believe to be a genuine application prompt (e.g. [GUI Input Capture](https://attack.mitre.org/techniques/T1417/002))." ; dcterms:modified "2025-10-24T17:49:11.864000+00:00"^^xsd:dateTime ; dcterms:title "Input Capture" ; dcterms:version "2.3" ; attack:isSubtechnique false . attack-res:attack-pattern--a8e971b8-8dc7-4514-8249-ae95427ec467 a attack:Technique ; dcterms:created "2022-04-06T13:55:14.390000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may generate outbound traffic from devices. This is typically performed to manipulate external outcomes, such as to achieve carrier billing fraud or to manipulate app store rankings or ratings. Outbound traffic is typically generated as SMS messages or general web traffic, but may take other forms as well. If done via SMS messages, Android apps must hold the `SEND_SMS` permission. Additionally, sending an SMS message requires user consent if the recipient is a premium number. Applications cannot send SMS messages on iOS""" ; dcterms:modified "2025-10-24T17:49:12.043000+00:00"^^xsd:dateTime ; dcterms:title "Generate Traffic from Victim" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--a91262d5-b9ff-463f-b8d2-12e4ea1eb3c9 a attack:Technique ; dcterms:created "2022-04-08T16:29:30.087000+00:00"^^xsd:dateTime ; dcterms:description "An adversary could use knowledge of the techniques used by security software to evade detection.(Citation: Brodie)(Citation: Tan) For example, some mobile security products perform compromised device detection by searching for particular artifacts such as an installed \"su\" binary, but that check could be evaded by naming the binary something else. Similarly, polymorphic code techniques could be used to evade signature-based detection.(Citation: Rastogi)" ; dcterms:modified "2025-10-24T17:49:12.130000+00:00"^^xsd:dateTime ; dcterms:title "Disguise Root/Jailbreak Indicators" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--a9fa0d30-a8ff-45bf-922e-7720da0b7922 a attack:Technique ; dcterms:created "2022-04-01T12:48:27.021000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may utilize standard operating system APIs to gather calendar entry data. On Android, this can be accomplished using the Calendar Content Provider. On iOS, this can be accomplished using the `EventKit` framework. If the device has been jailbroken or rooted, an adversary may be able to access [Calendar Entries](https://attack.mitre.org/techniques/T1636/001) without the user’s knowledge or approval. """ ; dcterms:modified "2025-10-24T17:49:12.650000+00:00"^^xsd:dateTime ; dcterms:title "Calendar Entries" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--ab7400b7-3476-4776-9545-ef3fa373de63 a attack:Technique ; dcterms:created "2022-03-30T19:36:09.691000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity. An application must have administrator access to fully wipe the device, while individual files may not require special permissions to delete depending on their storage location.(Citation: Android DevicePolicyManager 2019) Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The impact file deletion will have depends on the type of data as well as the goals and objectives of the adversary, but can include deleting update files to evade detection or deleting attacker-specified files for impact.""" ; dcterms:modified "2026-05-12T15:12:00.707000+00:00"^^xsd:dateTime ; dcterms:title "File Deletion" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--acf8fd2a-dc98-43b4-8d37-64e10728e591 a attack:Technique ; dcterms:created "2022-04-01T18:49:03.892000+00:00"^^xsd:dateTime ; dcterms:description """An adversary may seek to inhibit user interaction by locking the legitimate user out of the device. This is typically accomplished by requesting device administrator permissions and then locking the screen using `DevicePolicyManager.lockNow()`. Other novel techniques for locking the user out of the device have been observed, such as showing a persistent overlay, using carefully crafted “call” notification screens, and locking HTML pages in the foreground. These techniques can be very difficult to get around, and typically require booting the device into safe mode to uninstall the malware.(Citation: Microsoft MalLockerB)(Citation: Talos GPlayed)(Citation: securelist rotexy 2018) Prior to Android 7, device administrators were able to reset the device lock passcode to prevent the user from unlocking the device. The release of Android 7 introduced updates that only allow device or profile owners (e.g. MDMs) to reset the device’s passcode.(Citation: Android resetPassword)""" ; dcterms:modified "2025-10-24T17:49:13.285000+00:00"^^xsd:dateTime ; dcterms:title "Device Lockout" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--b1c95426-2550-4621-8028-ceebf28b3a47 a attack:Technique ; dcterms:created "2022-04-05T19:45:03+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them. Some methods of keylogging include: * Masquerading as a legitimate third-party keyboard to record user keystrokes.(Citation: Zeltser-Keyboard) On both Android and iOS, users must explicitly authorize the use of third-party keyboard apps. Users should be advised to use extreme caution before granting this authorization when it is requested. * Abusing accessibility features. On Android, adversaries may abuse accessibility features to record keystrokes by registering an `AccessibilityService` class, overriding the `onAccessibilityEvent` method, and listening for the `AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED` event type. The event object passed into the function will contain the data that the user typed. *Additional methods of keylogging may be possible if root access is available. """ ; dcterms:modified "2026-05-12T15:12:00.707000+00:00"^^xsd:dateTime ; dcterms:title "Keylogging" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--b327a9c0-e709-495c-aa6e-00b042136e2b a attack:Technique ; dcterms:created "2020-09-11T15:14:33.730000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware, or various external effects. This can be accomplished by requesting the `RECEIVE_SMS` or `SEND_SMS` permissions depending on what the malware is attempting to do. If the app is set as the default SMS handler on the device, the `SMS_DELIVER` broadcast intent can be registered, which allows the app to write to the SMS content provider. The content provider directly modifies the messaging database on the device, which could allow malicious applications with this ability to insert, modify, or delete arbitrary messages on the device.(Citation: SMS KitKat)(Citation: Android SmsProvider)""" ; dcterms:modified "2026-05-12T15:12:00.708000+00:00"^^xsd:dateTime ; dcterms:title "SMS Control" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--b7c0e45f-0206-4f75-96e7-fe7edad3aaff a attack:Technique ; dcterms:created "2022-03-30T18:50:43.393000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may inject code into processes in order to evade process-based defenses or even elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. Both Android and iOS have no legitimate way to achieve process injection. The only way this is possible is by abusing existing root access or exploiting a vulnerability.""" ; dcterms:modified "2025-10-24T17:49:16.232000+00:00"^^xsd:dateTime ; dcterms:title "Process Injection" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--bb4387ab-7a51-468b-bf5f-a9a8612f0303 a attack:Technique ; dcterms:created "2022-04-05T20:14:17.310000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, Blowfish, and RC4." ; dcterms:modified "2025-10-24T17:49:17.802000+00:00"^^xsd:dateTime ; dcterms:title "Symmetric Cryptography" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--be63612f-a48f-44f2-a7a6-1763509fcf80 a attack:Technique ; dcterms:created "2024-02-21T20:44:44.404000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Discovery](https://attack.mitre.org/tactics/TA0032) or [Credential Access](https://attack.mitre.org/tactics/TA0031) activity to support both ongoing and future campaigns. " ; dcterms:modified "2026-05-12T15:12:00.713000+00:00"^^xsd:dateTime ; dcterms:title "Wi-Fi Discovery" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--c08366bb-8d11-4921-853f-f0a3b6a2a1da a attack:Technique ; dcterms:created "2022-03-28T19:30:15.556000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. " ; dcterms:modified "2025-10-24T17:49:19.406000+00:00"^^xsd:dateTime ; dcterms:title "Compromise Hardware Supply Chain" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--c4b96c0b-cb58-497a-a1c2-bb447d79d692 a attack:Technique ; dcterms:created "2017-10-25T14:48:19.996000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may abuse clipboard manager APIs to obtain sensitive information copied to the device clipboard. For example, passwords being copied and pasted from a password manager application could be captured by a malicious application installed on the device.(Citation: Fahl-Clipboard) On Android, applications can use the `ClipboardManager.OnPrimaryClipChangedListener()` API to register as a listener and monitor the clipboard for changes. However, starting in Android 10, this can only be used if the application is in the foreground, or is set as the device’s default input method editor (IME).(Citation: Github Capture Clipboard 2019)(Citation: Android 10 Privacy Changes) On iOS, this can be accomplished by accessing the `UIPasteboard.general.string` field. However, starting in iOS 14, upon accessing the clipboard, the user will be shown a system notification if the accessed text originated in a different application. For example, if the user copies the text of an iMessage from the Messages application, the notification will read “application_name has pasted from Messages” when the text was pasted in a different application.(Citation: UIPPasteboard)""" ; dcterms:modified "2025-10-24T17:49:21.369000+00:00"^^xsd:dateTime ; dcterms:title "Clipboard Data" ; dcterms:version "3.1" ; attack:isSubtechnique false . attack-res:attack-pattern--c548d8c4-a0a3-4a24-bb79-2a84abbc7b36 a attack:Technique ; dcterms:created "2022-04-06T13:34:46.021000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may insert, delete, or alter data in order to manipulate external outcomes or hide activity. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application, process, and the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system, typically gained through a prolonged information gathering campaign, in order to have the desired impact.""" ; dcterms:modified "2025-10-24T17:49:21.564000+00:00"^^xsd:dateTime ; dcterms:title "Data Manipulation" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--c6421411-ae61-42bb-9098-73fddb315002 a attack:Technique ; dcterms:created "2022-04-01T13:25:30.923000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider. iOS provides no standard API to access SMS messages. If the device has been jailbroken or rooted, an adversary may be able to access [SMS Messages](https://attack.mitre.org/techniques/T1636/004) without the user’s knowledge or approval. """ ; dcterms:modified "2026-05-12T15:12:00.715000+00:00"^^xsd:dateTime ; dcterms:title "SMS Messages" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--c6a146ae-9c63-4606-97ff-e261e76e8380 a attack:Technique ; dcterms:created "2019-02-01T17:29:43.503000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media, acting as a mechanism for C2, may give a significant amount of cover. This is due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis, or enable operational resiliency (since this infrastructure may be dynamically changed). """ ; dcterms:modified "2025-10-24T17:49:22.184000+00:00"^^xsd:dateTime ; dcterms:title "Web Service" ; dcterms:version "1.3" ; attack:isSubtechnique false . attack-res:attack-pattern--c6e17ca2-08b5-4379-9786-89bd05241831 a attack:Technique ; dcterms:created "2022-03-30T15:07:51.646000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may execute their own malicious payloads by hijacking the way an operating system runs applications. Hijacking execution flow can be for the purposes of persistence since this hijacked execution may reoccur at later points in time. On Android, adversaries may overwrite the standard OS API library with a malicious alternative to hook into core functions to achieve persistence. By doing this, the adversary’s code will be executed every time the overwritten API function is called by an app on the infected device.""" ; dcterms:modified "2025-10-24T17:49:22.267000+00:00"^^xsd:dateTime ; dcterms:title "System Runtime API Hijacking" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--cc6e0637-76d2-4af3-a604-9d8d3ff8a6b3 a attack:Technique ; dcterms:created "2022-04-01T14:55:10.494000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may search common password storage locations to obtain user credentials. Passwords can be stored in several places on a device, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users to manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information." ; dcterms:modified "2025-10-24T17:49:23.749000+00:00"^^xsd:dateTime ; dcterms:title "Credentials from Password Store" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--ccde43e4-78f9-4f32-b401-c081e7db71ea a attack:Technique ; dcterms:created "2021-09-24T14:47:34.182000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection. Hooking can be used to modify return values or data structures of system APIs and function calls. This process typically involves using 3rd party root frameworks, such as Xposed or Magisk, with either a system exploit or pre-existing root access. By including custom modules for root frameworks, adversaries can hook system APIs and alter the return value and/or system data structures to alter functionality/visibility of various aspects of the system." ; dcterms:modified "2025-10-24T17:49:24.183000+00:00"^^xsd:dateTime ; dcterms:title "Hooking" ; dcterms:version "1.0" ; attack:isSubtechnique false . attack-res:attack-pattern--cf28ca46-1fd3-46b4-b1f6-ec0b72361848 a attack:Technique ; dcterms:created "2017-10-25T14:48:21.965000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1420) during automated discovery to shape follow-on behaviors, including deciding if the adversary should fully infect the target and/or attempt specific actions. On Android, Linux file permissions and SELinux policies typically stringently restrict what can be accessed by apps without taking advantage of a privilege escalation exploit. The contents of the external storage directory are generally visible, which could present concerns if sensitive data is inappropriately stored there. iOS's security architecture generally restricts the ability to perform any type of [File and Directory Discovery](https://attack.mitre.org/techniques/T1420) without use of escalated privileges. """ ; dcterms:modified "2026-05-12T15:12:00.717000+00:00"^^xsd:dateTime ; dcterms:title "File and Directory Discovery" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a a attack:Technique ; dcterms:created "2017-10-25T14:48:32.328000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Portions of files can also be encoded to hide the plaintext strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.(Citation: Microsoft MalLockerB) """ ; dcterms:modified "2026-05-12T15:12:00.717000+00:00"^^xsd:dateTime ; dcterms:title "Obfuscated Files or Information" ; dcterms:version "3.1" ; attack:isSubtechnique false . attack-res:attack-pattern--d1f1337e-aea7-454c-86bd-482a98ffaf62 a attack:Technique ; dcterms:created "2019-09-15T15:26:22.356000+00:00"^^xsd:dateTime ; dcterms:description """A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs. [Input Injection](https://attack.mitre.org/techniques/T1516) can be achieved using any of the following methods: * Mimicking user clicks on the screen, for example to steal money from a user's PayPal account.(Citation: android-trojan-steals-paypal-2fa) * Injecting global actions, such as `GLOBAL_ACTION_BACK` (programatically mimicking a physical back button press), to trigger actions on behalf of the user.(Citation: Talos Gustuff Apr 2019) * Inserting input into text fields on behalf of the user. This method is used legitimately to auto-fill text fields by applications such as password managers.(Citation: bitwarden autofill logins)""" ; dcterms:modified "2026-05-12T15:12:00.717000+00:00"^^xsd:dateTime ; dcterms:title "Input Injection" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--d2e112dc-f6d4-488d-b8df-ecbfb57a0a2d a attack:Technique ; dcterms:created "2017-10-25T14:48:25.740000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth that services rely on, or by jamming the signal going to or coming from devices. A Network DoS will occur when an adversary is able to jam radio signals (e.g. Wi-Fi, cellular, GPS) around a device to prevent it from communicating. For example, to jam cellular signal, an adversary may use a handheld signal jammer, which jam devices within the jammer’s operational range.(Citation: NIST-SP800187) Usage of cellular jamming has been documented in several arrests reported in the news.(Citation: CNET-Celljammer)(Citation: NYTimes-Celljam)(Citation: Digitaltrends-Celljam)(Citation: Arstechnica-Celljam)""" ; dcterms:modified "2025-05-19T15:21:04.030000+00:00"^^xsd:dateTime ; dcterms:title "Network Denial of Service" ; dcterms:version "1.4" ; attack:isSubtechnique false . attack-res:attack-pattern--d3bc5020-f6a2-41c0-8ccb-5e563101b60c a attack:Technique ; dcterms:created "2020-05-07T15:24:49.068000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may modify applications installed on a device to establish persistent access to a victim. These malicious modifications can be used to make legitimate applications carry out adversary tasks when these applications are in use. There are multiple ways an adversary can inject malicious code into applications. One method is by taking advantages of device vulnerabilities, the most well-known being Janus, an Android vulnerability that allows adversaries to add extra bytes to APK (application) and DEX (executable) files without affecting the file's signature. By being able to add arbitrary bytes to valid applications, attackers can seamlessly inject code into genuine executables without the user's knowledge.(Citation: Guardsquare Janus) Adversaries may also rebuild applications to include malicious modifications. This can be achieved by decompiling the genuine application, merging it with the malicious code, and recompiling it.(Citation: CheckPoint Agent Smith) Adversaries may also take action to conceal modifications to application executables and bypass user consent. These actions include altering modifications to appear as an update or exploiting vulnerabilities that allow activities of the malicious application to run inside a system application.(Citation: CheckPoint Agent Smith)""" ; dcterms:modified "2025-10-24T17:49:26.629000+00:00"^^xsd:dateTime ; dcterms:title "Compromise Application Executable" ; dcterms:version "1.0" ; attack:isSubtechnique false . attack-res:attack-pattern--d446b9f0-06a9-4a8d-97ee-298cfee84f14 a attack:Technique ; dcterms:created "2022-03-30T14:25:41.721000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to subscribe to events such as receiving an SMS message, device boot completion, or other device activities. Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via automatically and repeatedly executing malicious code. After gaining access to a victim’s system, adversaries may create or modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked. """ ; dcterms:modified "2025-10-24T17:49:26.888000+00:00"^^xsd:dateTime ; dcterms:title "Event Triggered Execution" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--d4536441-1bcc-49fa-80ae-a596ed3f7ffd a attack:Technique ; dcterms:created "2017-10-25T14:48:32.740000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of devices they access or through information discovery of remote systems. Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1422) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next. On Android, details of onboard network interfaces are accessible to apps through the `java.net.NetworkInterface` class.(Citation: NetworkInterface) Previously, the Android `TelephonyManager` class could be used to gather telephony-related device identifiers, information such as the IMSI, IMEI, and phone number. However, starting with Android 10, only preloaded, carrier, the default SMS, or device and profile owner applications can access the telephony-related device identifiers.(Citation: TelephonyManager) On iOS, gathering network configuration information is not possible without root access. Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1422) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next. """ ; dcterms:modified "2026-05-12T15:12:00.717000+00:00"^^xsd:dateTime ; dcterms:title "System Network Configuration Discovery" ; dcterms:version "2.4" ; attack:isSubtechnique false . attack-res:attack-pattern--d8940e76-f9c1-4912-bea6-e21c251370b6 a attack:Technique ; dcterms:created "2019-08-09T16:14:58.254000+00:00"^^xsd:dateTime ; dcterms:description """An adversary can leverage a device’s cameras to gather information by capturing video recordings. Images may also be captured, potentially in specified intervals, in lieu of video files. Malware or scripts may interact with the device cameras through an available API provided by the operating system. Video or image files may be written to disk and exfiltrated later. This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1513) due to use of the device’s cameras for video recording rather than capturing the victim’s screen. In Android, an application must hold the `android.permission.CAMERA` permission to access the cameras. In iOS, applications must include the `NSCameraUsageDescription` key in the `Info.plist` file. In both cases, the user must grant permission to the requesting application to use the camera. If the device has been rooted or jailbroken, an adversary may be able to access the camera without knowledge of the user. """ ; dcterms:modified "2026-05-12T15:12:00.721000+00:00"^^xsd:dateTime ; dcterms:title "Video Capture" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--d916f176-a1ca-4a78-9fdd-4058bc28162e a attack:Technique ; dcterms:created "2022-04-06T15:52:07.711000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use an existing, legitimate external Web service channel as a means for sending commands to a compromised system without receiving return output. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media, acting as a mechanism for C2, may give a significant amount of cover. This is due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. """ ; dcterms:modified "2025-10-24T17:49:28.337000+00:00"^^xsd:dateTime ; dcterms:title "One-Way Communication" ; dcterms:version "1.2" ; attack:isSubtechnique true . attack-res:attack-pattern--d9e88203-2b5d-405f-a406-2933b1e3d7e4 a attack:Technique ; dcterms:created "2017-10-25T14:48:10.285000+00:00"^^xsd:dateTime ; dcterms:description "An adversary may encrypt files stored on a mobile device to prevent the user from accessing them. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted." ; dcterms:modified "2025-10-24T17:49:28.514000+00:00"^^xsd:dateTime ; dcterms:title "Data Encrypted for Impact" ; dcterms:version "3.2" ; attack:isSubtechnique false . attack-res:attack-pattern--dc01774a-d1c1-45fb-b506-0a5d1d6593d9 a attack:Technique ; dcterms:created "2022-04-01T18:44:32.808000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may abuse the Android device administration API to prevent the user from uninstalling a target application. In earlier versions of Android, device administrator applications needed their administration capabilities explicitly deactivated by the user before the application could be uninstalled. This was later updated so the user could deactivate and uninstall the administrator application in one step. Adversaries may also abuse the device accessibility APIs to prevent removal. This set of APIs allows the application to perform certain actions on behalf of the user and programmatically determine what is being shown on the screen. The malicious application could monitor the device screen for certain modals (e.g., the confirmation modal to uninstall an application) and inject screen input or a back button tap to close the modal. For example, Android's `performGlobalAction(int)` API could be utilized to prevent the user from removing the malicious application from the device after installation. If the user wants to uninstall the malicious application, two cases may occur, both preventing the user from removing the application. * Case 1: If the integer argument passed to the API call is `2` or `GLOBAL_ACTION_HOME`, the malicious application may direct the user to the home screen from settings screen * Case 2: If the integer argument passed to the API call is `1` or `GLOBAL_ACTION_BACK`, the malicious application may emulate the back press event """ ; dcterms:modified "2026-05-12T15:12:00.721000+00:00"^^xsd:dateTime ; dcterms:title "Prevent Application Removal" ; dcterms:version "1.2" ; attack:isSubtechnique true . attack-res:attack-pattern--dd818ea5-adf5-41c7-93b5-f3b839a219fb a attack:Technique ; dcterms:created "2017-10-25T14:48:33.574000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network. This is typically accomplished by utilizing device APIs to collect information about nearby networks, such as Wi-Fi, Bluetooth, and cellular tower connections. On Android, this can be done by querying the respective APIs: * `WifiInfo` for information about the current Wi-Fi connection, as well as nearby Wi-Fi networks. Querying the `WiFiInfo` API requires the application to hold the `ACCESS_FINE_LOCATION` permission. * `BluetoothAdapter` for information about Bluetooth devices, which also requires the application to hold several permissions granted by the user at runtime. * For Android versions prior to Q, applications can use the `TelephonyManager.getNeighboringCellInfo()` method. For Q and later, applications can use the `TelephonyManager.getAllCellInfo()` method. Both methods require the application hold the `ACCESS_FINE_LOCATION` permission.""" ; dcterms:modified "2025-10-24T17:49:29.321000+00:00"^^xsd:dateTime ; dcterms:title "System Network Connections Discovery" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--defc1257-4db1-4fb3-8ef5-bb77f63146df a attack:Technique ; dcterms:created "2023-09-21T19:35:15.552000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may send malicious content to users in order to gain access to their mobile devices. All forms of phishing are electronically delivered social engineering. Adversaries can conduct both non-targeted phishing, such as in mass malware spam campaigns, as well as more targeted phishing tailored for a specific individual, company, or industry, known as “spearphishing.” Phishing often involves social engineering techniques, such as posing as a trusted source, as well as evasion techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages. Mobile phishing may take various forms. For example, adversaries may send emails containing malicious attachments or links, typically to deliver and then execute malicious code on victim devices. Phishing may also be conducted via third-party services, like social media platforms. Adversaries may also impersonate executives of organizations to persuade victims into performing some action on their behalf. For example, adversaries will often use social engineering techniques in text messages to trick the victims into acting quickly, which leads to adversaries obtaining credentials and other information. Mobile devices are a particularly attractive target for adversaries executing phishing campaigns. Due to their smaller form factor than traditional desktop endpoints, users may not be able to notice minor differences between genuine and phishing websites. Further, mobile devices have additional sensors and radios that allow adversaries to execute phishing attempts over several different vectors, such as: - SMS messages: Adversaries may send SMS messages (known as “smishing”) from compromised devices to potential targets to convince the target to, for example, install malware, navigate to a specific website, or enable certain insecure configurations on their device. - Quick Response (QR) Codes: Adversaries may use QR codes (known as “quishing”) to redirect users to a phishing website. For example, an adversary could replace a legitimate public QR Code with one that leads to a different destination, such as a phishing website. A malicious QR code could also be delivered via other means, such as SMS or email. In the latter case, an adversary could utilize a malicious QR code in an email to pivot from the user’s desktop computer to their mobile device. - Phone Calls: Adversaries may call victims (known as "vishing") to persuade them to perform an action, such as providing login credentials or navigating to malicious websites. Common vishing targets include employees, especially executives of organizations, and help desks. This may also be used as a technique to perform the initial access on a mobile device, but then pivot to a desktop computer by having the victims perform actions on a desktop computer. With the rise of artificial intelligence (AI), adversaries may also use AI to clone a person’s voice, resulting in deepfake vishing. The cloned voice provides familiarity to the victims, increasing the likelihood of successful malicious actions performed by the victims. Additionally, adversaries may leave voicemails, which may use a real person’s voice or an AI-generated voice; these scams would urgently ask victims into calling back to perform an action, e.g. sending money or providing sensitive information and credentials. """ ; dcterms:modified "2026-05-12T15:12:00.722000+00:00"^^xsd:dateTime ; dcterms:title "Phishing" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--dfafc230-5465-4993-8dc5-f51fa9fec002 a attack:Technique ; dcterms:created "2024-03-29T15:04:38.566000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use [SSL Pinning](https://attack.mitre.org/techniques/T1521/003) to protect the C2 traffic from being intercepted and analyzed. [SSL Pinning](https://attack.mitre.org/techniques/T1521/003) is a technique commonly utilized by legitimate websites to ensure that encrypted communications are only allowed with a pre-defined certificate. If another certificate is presented, it could indicate device compromise, traffic interception, or another upstream issue. While benign usages are common, it is also possible for adversaries to abuse this technology to protect malicious C2 traffic. In normal, not pinned SSL validation, when a client connects to a server using HTTPS, it typically checks whether the server’s SSL/TLS certificate is signed by a trusted Certificate Authority (CA) in the device’s trust store. If the certificate is valid and signed by a trusted CA, the connection is established. However, with [SSL Pinning](https://attack.mitre.org/techniques/T1521/003) , the client is configured to trust a specific SSL/TLS certificate or public key, rather than relying on the device’s trust store. This means that even if the server’s certificate is signed by a trusted CA, the client will only establish the connection of the certificate or key is pinned. There are two types of [SSL Pinning](https://attack.mitre.org/techniques/T1521/003) : 1. Certificate Pinning: The client stores a copy of the server’s certificate and compares it with the certificate received during the SSL handshake. If the certificates match, then the client proceeds with the connection. This approach also works with self-signed certificates. 2. Public Key Pinning: Instead of pinning the entire certificate, the client pins just the public key extracted from the certificate. This is often more flexible, as it allows the server to renew its certificate without having to update the pinned certificate or breaking the SSL connection.""" ; dcterms:modified "2024-04-16T20:24:13.854000+00:00"^^xsd:dateTime ; dcterms:title "SSL Pinning" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--dfe29258-ce59-421c-9dee-e85cb9fa90cd a attack:Technique ; dcterms:created "2017-10-25T14:48:24.488000+00:00"^^xsd:dateTime ; dcterms:description """An adversary with physical access to a mobile device may seek to bypass the device’s lockscreen. Several methods exist to accomplish this, including: * Biometric spoofing: If biometric authentication is used, an adversary could attempt to spoof a mobile device’s biometric authentication mechanism. Both iOS and Android partly mitigate this attack by requiring the device’s passcode rather than biometrics to unlock the device after every device restart, and after a set or random amount of time.(Citation: SRLabs-Fingerprint)(Citation: TheSun-FaceID) * Unlock code bypass: An adversary could attempt to brute-force or otherwise guess the lockscreen passcode (typically a PIN or password), including physically observing (“shoulder surfing”) the device owner’s use of the lockscreen passcode. Mobile OS vendors partly mitigate this by implementing incremental backoff timers after a set number of failed unlock attempts, as well as a configurable full device wipe after several failed unlock attempts. * Vulnerability exploit: Techniques have been periodically demonstrated that exploit mobile devices to bypass the lockscreen. The vulnerabilities are generally patched by the device or OS vendor once disclosed.(Citation: Wired-AndroidBypass)(Citation: Kaspersky-iOSBypass) """ ; dcterms:modified "2026-05-12T15:12:00.722000+00:00"^^xsd:dateTime ; dcterms:title "Lockscreen Bypass" ; dcterms:version "1.3" ; attack:isSubtechnique false . attack-res:attack-pattern--e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86 a attack:Technique ; dcterms:created "2022-04-01T13:17:52.740000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may utilize standard operating system APIs to gather contact list data. On Android, this can be accomplished using the Contacts Content Provider. On iOS, this can be accomplished using the `Contacts` framework. If the device has been jailbroken or rooted, an adversary may be able to access the [Contact List](https://attack.mitre.org/techniques/T1636/003) without the user’s knowledge or approval. """ ; dcterms:modified "2026-05-12T15:12:00.722000+00:00"^^xsd:dateTime ; dcterms:title "Contact List" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--e1c912a9-e305-434b-9172-8a6ce3ec9c4a a attack:Technique ; dcterms:created "2019-10-10T15:12:42.790000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration. Access to local system data, which includes information stored by the operating system, often requires escalated privileges. Examples of local system data include authentication tokens, the device keyboard cache, Wi-Fi passwords, and photos. On Android, adversaries may also attempt to access files from external storage which may require additional storage-related permissions. """ ; dcterms:modified "2026-05-12T15:12:00.722000+00:00"^^xsd:dateTime ; dcterms:title "Data from Local System" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--e2c2249a-eb82-4614-8dd4-9c514dde65e2 a attack:Technique ; dcterms:created "2022-04-06T13:29:47.590000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: credentials changed) to remove access to accounts. " ; dcterms:modified "2025-10-24T17:49:31.052000+00:00"^^xsd:dateTime ; dcterms:title "Account Access Removal" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--e2ea7f6b-8d4f-49c3-819d-660530d12b77 a attack:Technique ; dcterms:created "2017-10-25T14:48:19.265000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may attempt to get detailed information about a device’s operating system and hardware, including versions, patches, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1426) during automated discovery to shape follow-on behaviors, including whether or not to fully infects the target and/or attempts specific actions. On Android, much of this information is programmatically accessible to applications through the `android.os.Build` class. (Citation: Android-Build) iOS is much more restrictive with what information is visible to applications. Typically, applications will only be able to query the device model and which version of iOS it is running. """ ; dcterms:modified "2026-05-12T15:12:00.722000+00:00"^^xsd:dateTime ; dcterms:title "System Information Discovery" ; dcterms:version "1.2" ; attack:isSubtechnique false . attack-res:attack-pattern--e3b936a4-6321-4172-9114-038a866362ec a attack:Technique ; dcterms:created "2019-10-10T15:00:44.181000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may compress and/or encrypt data that is collected prior to exfiltration. Compressing data can help to obfuscate its contents and minimize use of network resources. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, programming library, or custom algorithm. """ ; dcterms:modified "2025-10-24T17:49:31.761000+00:00"^^xsd:dateTime ; dcterms:title "Archive Collected Data" ; dcterms:version "2.0" ; attack:isSubtechnique false . attack-res:attack-pattern--e422b6fa-4739-46b9-992e-82f1b350c780 a attack:Technique ; dcterms:created "2022-03-30T20:36:03.177000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use a device’s geographical location to limit certain malicious behaviors. For example, malware operators may limit the distribution of a second stage payload to certain geographic regions.(Citation: Lookout eSurv) [Geofencing](https://attack.mitre.org/techniques/T1627/001) is accomplished by persuading the user to grant the application permission to access location services. The application can then collect, process, and exfiltrate the device’s location to perform location-based actions, such as ceasing malicious behavior or showing region-specific advertisements. One method to accomplish [Geofencing](https://attack.mitre.org/techniques/T1627/001) on Android is to use the built-in Geofencing API to automatically trigger certain behaviors when the device enters or exits a specified radius around a geographical location. Similar to other [Geofencing](https://attack.mitre.org/techniques/T1627/001) methods, this requires that the user has granted the `ACCESS_FINE_LOCATION` and `ACCESS_BACKGROUND_LOCATION` permissions. The latter is only required if the application targets Android 10 (API level 29) or higher. However, Android 11 introduced additional permission controls that may restrict background location collection based on user permission choices at runtime. These additional controls include "Allow only while using the app", which will effectively prohibit background location collection. Similarly, on iOS, developers can use built-in APIs to setup and execute geofencing. Depending on the use case, the app will either need to call `requestWhenInUseAuthorization()` or `requestAlwaysAuthorization()`, depending on when access to the location services is required. Similar to Android, users also have the option to limit when the application can access the device’s location, including one-time use and only when the application is running in the foreground. [Geofencing](https://attack.mitre.org/techniques/T1627/001) can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. For example, location data could be used to limit malware spread and/or capabilities, which could also potentially evade application analysis environments (ex: malware analysis outside of the target geographic area). Other malicious usages could include showing language-specific input prompts and/or advertisements.""" ; dcterms:modified "2025-10-24T17:49:31.935000+00:00"^^xsd:dateTime ; dcterms:title "Geofencing" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--ea132c68-b518-4478-ae8d-1763cda26ee3 a attack:Technique ; dcterms:created "2024-02-20T21:44:32.669000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may attempt to hide multimedia files from the user. By doing so, adversaries may conceal captured files, such as pictures, videos and/or screenshots, then later exfiltrate those files. Specific to Android devices, if the `.nomedia` file is present in a folder, multimedia files in that folder will not be visible to the user in the Gallery application. Additionally, other applications are asked not to scan the folder with the `.nomedia` file, effectively making the folder appear invisible to the user. This technique is often used by stalkerware and spyware applications. """ ; dcterms:modified "2024-04-17T16:50:41.414000+00:00"^^xsd:dateTime ; dcterms:title "Conceal Multimedia Files" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--eb6cf439-1bcb-4d10-bc68-1eed844ed7b3 a attack:Technique ; dcterms:created "2022-04-06T13:52:05.619000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. On Android versions prior to 7, apps can abuse Device Administrator access to reset the device lock passcode, preventing the user from unlocking the device. After Android 7, only device or profile owners (e.g. MDMs) can reset the device’s passcode.(Citation: Android resetPassword) On iOS devices, this technique does not work because mobile device management servers can only remove the screen lock passcode; they cannot set a new passcode. However, on jailbroken devices, malware has been discovered that can lock the user out of the device.(Citation: Xiao-KeyRaider)""" ; dcterms:modified "2025-10-24T17:49:33.803000+00:00"^^xsd:dateTime ; dcterms:title "Endpoint Denial of Service" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--ec4c4baa-026f-43e8-8f56-58c36f3162dd a attack:Technique ; dcterms:created "2022-04-06T15:27:34.300000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may communicate with compromised devices using out of band data streams. This could be done for a variety of reasons, including evading network traffic monitoring, as a backup method of command and control, or for data exfiltration if the device is not connected to any Internet-providing networks (i.e. cellular or Wi-Fi). Several out of band data streams exist, such as SMS messages, NFC, and Bluetooth. On Android, applications can read push notifications to capture content from SMS messages, or other out of band data streams. This requires that the user manually grant notification access to the application via the settings menu. However, the application could launch an Intent to take the user directly there. On iOS, there is no way to programmatically read push notifications. """ ; dcterms:modified "2025-10-24T17:49:34.162000+00:00"^^xsd:dateTime ; dcterms:title "Out of Band Data" ; dcterms:version "2.1" ; attack:isSubtechnique false . attack-res:attack-pattern--ed2c05a1-4f81-4d97-9e1b-aff01c34ae84 a attack:Technique ; dcterms:created "2019-10-01T14:18:47.762000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files." ; dcterms:modified "2025-10-24T17:49:34.332000+00:00"^^xsd:dateTime ; dcterms:title "Encrypted Channel" ; dcterms:version "2.0" ; attack:isSubtechnique false . attack-res:attack-pattern--f05fc151-aa62-47e3-ae57-2d1b23d64bf6 a attack:Technique ; dcterms:created "2022-03-30T20:06:22.194000+00:00"^^xsd:dateTime ; dcterms:description """A malicious application could suppress its icon from being displayed to the user in the application launcher. This hides the fact that it is installed, and can make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions. This behavior has been seen in the BankBot/Spy Banker family of malware.(Citation: android-trojan-steals-paypal-2fa)(Citation: sunny-stolen-credentials)(Citation: bankbot-spybanker) Beginning in Android 10, changes were introduced to inhibit malicious applications’ ability to hide their icon. If an app is a system app, requests no permissions, or does not have a launcher activity, the application’s icon will be fully hidden. Further, if the device is fully managed or the application is in a work profile, the icon will be fully hidden. Otherwise, a synthesized activity is shown, which is a launcher icon that represents the app’s details page in the system settings. If the user clicks the synthesized activity in the launcher, they are taken to the application’s details page in the system settings.(Citation: Android 10 Limitations to Hiding App Icons)(Citation: LauncherApps getActivityList)""" ; dcterms:modified "2025-10-24T17:49:35.410000+00:00"^^xsd:dateTime ; dcterms:title "Suppress Application Icon" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--f856eaab-e84a-4265-a8a2-7bf37e5dc2fc a attack:Technique ; dcterms:created "2023-07-12T20:29:48.758000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name, location, or appearance of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1655) """ ; dcterms:modified "2026-05-12T15:12:00.725000+00:00"^^xsd:dateTime ; dcterms:title "Masquerading" ; dcterms:version "1.0" ; attack:isSubtechnique false . attack-res:attack-pattern--fa801609-ca8e-415e-815e-65f3826ff4df a attack:Technique ; dcterms:created "2022-03-30T19:19:23.777000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files." ; dcterms:modified "2025-10-24T17:49:38.813000+00:00"^^xsd:dateTime ; dcterms:title "Steganography" ; dcterms:version "1.0" ; attack:isSubtechnique true . attack-res:attack-pattern--fc53309d-ebd5-4573-9242-57024ebdad4f a attack:Technique ; dcterms:created "2022-03-30T20:00:12.654000+00:00"^^xsd:dateTime ; dcterms:description "Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Mobile operating systems have features and developer APIs to hide various artifacts, such as an application’s launcher icon. These APIs have legitimate usages, such as hiding an icon to avoid application drawer clutter when an application does not have a usable interface. Adversaries may abuse these features and APIs to hide artifacts from the user to evade detection." ; dcterms:modified "2025-10-24T17:49:39.161000+00:00"^^xsd:dateTime ; dcterms:title "Hide Artifacts" ; dcterms:version "1.1" ; attack:isSubtechnique false . attack-res:attack-pattern--fcb11f06-ce0e-490b-bcc1-04a1623579f0 a attack:Technique ; dcterms:created "2022-03-30T18:13:26.003000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may modify code signing policies to enable execution of applications signed with unofficial or unknown keys. Code signing provides a level of authenticity on an app from a developer, guaranteeing that the program has not been tampered with and comes from an official source. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on a device. Mobile devices generally enable these security controls by default, such as preventing the installation of unknown applications on Android. Adversaries may modify these policies in a number of ways, including [Input Injection](https://attack.mitre.org/techniques/T1516) or malicious configuration profiles.""" ; dcterms:modified "2025-10-24T17:49:39.422000+00:00"^^xsd:dateTime ; dcterms:title "Code Signing Policy Modification" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--fd211238-f767-4599-8c0d-9dca36624626 a attack:Technique ; dcterms:created "2022-04-05T19:59:03.161000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may use [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1637/001) (DGAs) to procedurally generate domain names for uses such as command and control communication or malicious application distribution.(Citation: securelist rotexy 2018) DGAs increase the difficulty for defenders to block, track, or take over the command and control channel, as there could potentially be thousands of domains that malware can check for instructions.""" ; dcterms:modified "2025-10-24T17:49:39.530000+00:00"^^xsd:dateTime ; dcterms:title "Domain Generation Algorithms" ; dcterms:version "1.1" ; attack:isSubtechnique true . attack-res:attack-pattern--fd339382-bfec-4bf0-8d47-1caedc9e7e57 a attack:Technique ; dcterms:created "2017-10-25T14:48:06.822000+00:00"^^xsd:dateTime ; dcterms:description """Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring an [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Multiple ways of delivering exploit code to a browser exist, including: * A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript, iFrames, and cross-site scripting. * Malicious ads are paid for and served through legitimate ad providers. * Built-in web application interfaces are leveraged for the insertion of any other kind of object that can be used to display web content or contain a script that executes on the visiting client (e.g. forum posts, comments, and other user controllable web content). Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted attack is referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring.(Citation: Lookout-StealthMango) Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. * The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, then it will give the adversary code execution on the user's system unless other protections are in place. * In some cases a second visit to the website after the initial scan is required before exploit code is delivered.""" ; dcterms:modified "2025-10-24T17:49:39.614000+00:00"^^xsd:dateTime ; dcterms:title "Drive-By Compromise" ; dcterms:version "2.2" ; attack:isSubtechnique false . attack-res:course-of-action--0beabf44-e8d8-4ae4-9122-ef56369a2564 a attack:Mitigation ; dcterms:description "New mobile operating system versions bring not only patches against discovered vulnerabilities but also often bring security architecture improvements that provide resilience against potential vulnerabilities or weaknesses that have not yet been discovered. They may also bring improvements that block use of observed adversary techniques." ; dcterms:title "Use Recent OS Version" ; dcterms:version "1.0" . attack-res:course-of-action--25dc1ce8-eb55-4333-ae30-a7cb4f5894a1 a attack:Mitigation ; dcterms:description """Application Developer Guidance focuses on providing developers with the knowledge, tools, and best practices needed to write secure code, reduce vulnerabilities, and implement secure design principles. By integrating security throughout the software development lifecycle (SDLC), this mitigation aims to prevent the introduction of exploitable weaknesses in applications, systems, and APIs. This mitigation can be implemented through the following measures: Preventing SQL Injection (Secure Coding Practice): - Implementation: Train developers to use parameterized queries or prepared statements instead of directly embedding user input into SQL queries. - Use Case: A web application accepts user input to search a database. By sanitizing and validating user inputs, developers can prevent attackers from injecting malicious SQL commands. Cross-Site Scripting (XSS) Mitigation: - Implementation: Require developers to implement output encoding for all user-generated content displayed on a web page. - Use Case: An e-commerce site allows users to leave product reviews. Properly encoding and escaping user inputs prevents malicious scripts from being executed in other users’ browsers. Secure API Design: - Implementation: Train developers to authenticate all API endpoints and avoid exposing sensitive information in API responses. - Use Case: A mobile banking application uses APIs for account management. By enforcing token-based authentication for every API call, developers reduce the risk of unauthorized access. Static Code Analysis in the Build Pipeline: - Implementation: Incorporate tools into CI/CD pipelines to automatically scan for vulnerabilities during the build process. - Use Case: A fintech company integrates static analysis tools to detect hardcoded credentials in their source code before deployment. Threat Modeling in the Design Phase: - Implementation: Use frameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to assess threats during application design. - Use Case: Before launching a customer portal, a SaaS company identifies potential abuse cases, such as session hijacking, and designs mitigations like secure session management. **Tools for Implementation**: - Static Code Analysis Tools: Use tools that can scan for known vulnerabilities in source code. - Dynamic Application Security Testing (DAST): Use tools like Burp Suite or OWASP ZAP to simulate runtime attacks and identify vulnerabilities. - Secure Frameworks: Recommend secure-by-default frameworks (e.g., Django for Python, Spring Security for Java) that enforce security best practices.""" ; dcterms:title "Application Developer Guidance" ; dcterms:version "1.2" . attack-res:course-of-action--649f7268-4c12-483b-ac84-4b7bca9fe2ee a attack:Mitigation ; dcterms:description "An enterprise mobility management (EMM), also known as mobile device management (MDM), system can be used to provision policies to mobile devices to control aspects of their allowed behavior." ; dcterms:title "Enterprise Policy" ; dcterms:version "1.0" . attack-res:course-of-action--653492e3-27be-4a0e-b08c-938dd2b7e0e1 a attack:Mitigation ; dcterms:description "Describes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors." ; dcterms:title "User Guidance" ; dcterms:version "1.0" . attack-res:course-of-action--76a32151-5233-465f-a607-7e576c62c932 a attack:Mitigation ; dcterms:description "This category is to associate techniques that mitigation might increase risk of compromise and therefore mitigation is not recommended." ; dcterms:title "Do Not Mitigate" ; dcterms:version "1.0" . attack-res:course-of-action--78671282-26aa-486c-a7a5-5921e1616b58 a attack:Mitigation ; dcterms:description "Mobile security products, such as Mobile Threat Defense (MTD), offer various device-based mitigations against certain behaviors." ; dcterms:title "Antivirus/Antimalware" ; dcterms:version "1.0" . attack-res:course-of-action--7b1cf46f-784b-405a-a8dd-4624c19d8321 a attack:Mitigation ; dcterms:description "Ensure that Android devices being used include and enable the Verified Boot capability, which cryptographically ensures the integrity of the system partition." ; dcterms:title "System Partition Integrity" ; dcterms:version "1.0" . attack-res:course-of-action--8220b57e-c400-4525-bf69-f8edc6b389a8 a attack:Mitigation ; dcterms:description """Application developers should encrypt all of their application network traffic using the Transport Layer Security (TLS) protocol to ensure protection of sensitive data and deter network-based attacks. If desired, application developers could perform message-based encryption of data before passing it for TLS encryption. iOS's App Transport Security feature can be used to help ensure that all application network traffic is appropriately protected. Apple intends to mandate use of App Transport Security (Citation: TechCrunch-ATS) for all apps in the Apple App Store unless appropriate justification is given. Android's Network Security Configuration feature similarly can be used by app developers to help ensure that all of their application network traffic is appropriately protected (Citation: Android-NetworkSecurityConfig). Use of Virtual Private Network (VPN) tunnels, e.g. using the IPsec protocol, can help mitigate some types of network attacks as well.""" ; dcterms:title "Encrypt Network Traffic" ; dcterms:version "1.0" . attack-res:course-of-action--8ccd428d-39da-4e8f-a55b-d48ea1d56e58 a attack:Mitigation ; dcterms:description "On devices that provide the capability to unlock the bootloader (hence allowing any operating system code to be flashed onto the device), perform periodic checks to ensure that the bootloader is locked." ; dcterms:title "Lock Bootloader" ; dcterms:version "1.0" . attack-res:course-of-action--bcecd036-f40e-4916-9f8e-fd0ccf0ece8d a attack:Mitigation ; dcterms:description """Install security updates in response to discovered vulnerabilities. Purchase devices with a vendor and/or mobile carrier commitment to provide security updates in a prompt manner for a set period of time. Decommission devices that will no longer receive security updates. Limit or block access to enterprise resources from devices that have not installed recent security updates. On Android devices, access can be controlled based on each device's security patch level. On iOS devices, access can be controlled based on the iOS version.""" ; dcterms:title "Security Updates" ; dcterms:version "1.0" . attack-res:course-of-action--cf2cccb1-cab8-431a-8ecf-f7874d05f433 a attack:Mitigation ; dcterms:description "A variety of methods exist that can be used to enable enterprises to identify compromised (e.g. rooted/jailbroken) devices, whether using security mechanisms built directly into the device, third-party mobile security applications, enterprise mobility management (EMM)/mobile device management (MDM) capabilities, or other methods. Some methods may be trivial to evade while others may be more sophisticated." ; dcterms:title "Deploy Compromised Device Detection Method" ; dcterms:version "1.0" . attack-res:course-of-action--e829ee51-1caf-4665-ba15-7f8979634124 a attack:Mitigation ; dcterms:description "In order to mitigate Signaling System 7 (SS7) exploitation, the Communications, Security, Reliability, and Interoperability Council (CSRIC) describes filtering interconnections between network operators to block inappropriate requests (Citation: CSRIC5-WG10-FinalReport)." ; dcterms:title "Interconnection Filtering" ; dcterms:version "1.0" . attack-res:course-of-action--ff4821f6-5afb-481b-8c0f-26c28c0d666c a attack:Mitigation ; dcterms:description "Enable remote attestation capabilities when available (such as Android SafetyNet or Samsung Knox TIMA Attestation) and prohibit devices that fail the attestation from accessing enterprise resources." ; dcterms:title "Attestation" ; dcterms:version "1.0" . attack-res:intrusion-set--049cef3b-22d5-4be6-b50c-9839c7a34fdd a attack:AdversaryGroup ; dcterms:description "[Bouncing Golf](https://attack.mitre.org/groups/G0097) is a cyberespionage campaign targeting Middle Eastern countries.(Citation: Trend Micro Bouncing Golf 2019)" ; dcterms:title "Bouncing Golf" ; dcterms:version "1.0" . attack-res:intrusion-set--0ec2f388-bf0f-4b5c-97b1-fc736d26c25f a attack:AdversaryGroup ; dcterms:description """[Kimsuky](https://attack.mitre.org/groups/G0094) is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. [Kimsuky](https://attack.mitre.org/groups/G0094) operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.(Citation: EST Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024) [Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019) In 2023, [Kimsuky](https://attack.mitre.org/groups/G0094) was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.(Citation: MSFT-AI) DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under [Lazarus Group](https://attack.mitre.org/groups/G0032), rather than tracking operationally distinct subgroups.""" ; dcterms:title "Kimsuky" ; dcterms:version "5.2" . attack-res:intrusion-set--17862c7d-9e60-48a0-b48e-da4dc4c3f6b0 a attack:AdversaryGroup ; dcterms:description "[Patchwork](https://attack.mitre.org/groups/G0040) is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. [Patchwork](https://attack.mitre.org/groups/G0040) has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. [Patchwork](https://attack.mitre.org/groups/G0040) was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.(Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)" ; dcterms:title "Patchwork" ; dcterms:version "1.7" . attack-res:intrusion-set--18854f55-ac7c-4634-bd9a-352dd07613b7 a attack:AdversaryGroup ; dcterms:description """[APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://attack.mitre.org/groups/G0096) has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.(Citation: apt41_mandiant) Notable behaviors include using a wide range of malware and tools to complete mission objectives. [APT41](https://attack.mitre.org/groups/G0096) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021) """ ; dcterms:title "APT41" ; dcterms:version "4.2" . attack-res:intrusion-set--1f322d74-4822-4d60-8f64-414eea8a9258 a attack:AdversaryGroup ; dcterms:description "[UNC788](https://attack.mitre.org/groups/G1029) is a group of hackers from Iran that has targeted people in the Middle East.(Citation: Meta Adversarial Threat Report 2022)" ; dcterms:title "UNC788" ; dcterms:version "1.0" . attack-res:intrusion-set--269e8108-68c6-4f99-b911-14b2e765dec2 a attack:AdversaryGroup ; dcterms:description "[MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at least 2017, [MuddyWater](https://attack.mitre.org/groups/G0069) has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. [MuddyWater](https://attack.mitre.org/groups/G0069) has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, [MuddyWater](https://attack.mitre.org/groups/G0069) used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. (Citation: FalconFeeds_Iran_Mar2026)(Citation: Huntio_IranInfra_Mar2026)(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)(Citation: NaumaanProofpoint_GlobalClickFix_April2025)(Citation: ESET_MuddyWater_Dec2025)(Citation: SymantecCarbonBlack_Seedworm_Mar2026) " ; dcterms:title "MuddyWater" ; dcterms:version "7.0" . attack-res:intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192 a attack:AdversaryGroup ; dcterms:description """[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020) In October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://attack.mitre.org/groups/G0007).(Citation: US District Court Indictment GRU Oct 2018)""" ; dcterms:title "Sandworm Team" ; dcterms:version "4.2" . attack-res:intrusion-set--44d37b89-a739-4810-9111-0d2617a8939b a attack:AdversaryGroup ; dcterms:description """[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since at least 2022. (Citation: CrowdStrike Scattered Spider Profile) (Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. (Citation: MSTIC Octo Tempest Operations October 2023) [Scattered Spider](https://attack.mitre.org/groups/G1015) relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. (Citation: CISA Scattered Spider Advisory November 2023) (Citation: CrowdStrike Scattered Spider BYOVD January 2023) (Citation: Crowdstrike TELCO BPO Campaign December 2022) [Scattered Spider](https://attack.mitre.org/groups/G1015) had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. (Citation: Mandiant UNC3944 May 2025)""" ; dcterms:title "Scattered Spider" ; dcterms:version "3.0" . attack-res:intrusion-set--6eded342-33e5-4451-b6b2-e1c62863129f a attack:AdversaryGroup ; dcterms:description "[Confucius](https://attack.mitre.org/groups/G0142) is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between [Confucius](https://attack.mitre.org/groups/G0142) and [Patchwork](https://attack.mitre.org/groups/G0040), particularly in their respective custom malware code and targets.(Citation: TrendMicro Confucius APT Feb 2018)(Citation: TrendMicro Confucius APT Aug 2021)(Citation: Uptycs Confucius APT Jan 2021)" ; dcterms:title "Confucius" ; dcterms:version "1.1" . attack-res:intrusion-set--7251b44b-6072-476c-b8d9-a6e32c355b28 a attack:AdversaryGroup ; dcterms:description "[MoustachedBouncer](https://attack.mitre.org/groups/G1019) is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.(Citation: MoustachedBouncer ESET August 2023)" ; dcterms:title "MoustachedBouncer" ; dcterms:version "1.0" . attack-res:intrusion-set--7f848c02-4d1e-4808-a4ae-4670681370a9 a attack:AdversaryGroup ; dcterms:description "[BITTER](https://attack.mitre.org/groups/G1002) is a suspected South Asian cyber espionage threat group that has been active since at least 2013. [BITTER](https://attack.mitre.org/groups/G1002) has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)" ; dcterms:title "BITTER" ; dcterms:version "1.1" . attack-res:intrusion-set--8332952e-b86b-486b-acc3-1c2a85d39394 a attack:AdversaryGroup ; dcterms:description "[APT-C-23](https://attack.mitre.org/groups/G1028) is a threat group that has been active since at least 2014.(Citation: symantec_mantis) [APT-C-23](https://attack.mitre.org/groups/G1028) has primarily focused its operations on the Middle East, including Israeli military assets. [APT-C-23](https://attack.mitre.org/groups/G1028) has developed mobile spyware targeting Android and iOS devices since 2017.(Citation: welivesecurity_apt-c-23)" ; dcterms:title "APT-C-23" ; dcterms:version "1.0" . attack-res:intrusion-set--8a831aaa-f3e0-47a3-bed8-a9ced744dd12 a attack:AdversaryGroup ; dcterms:description "[Dark Caracal](https://attack.mitre.org/groups/G0070) is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012. (Citation: Lookout Dark Caracal Jan 2018)" ; dcterms:title "Dark Caracal" ; dcterms:version "1.4" . attack-res:intrusion-set--9b36c218-4d80-4ec6-a68d-cc2886bbe410 a attack:AdversaryGroup ; dcterms:description """[Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia that has been active since at least 2019. [Star Blizzard](https://attack.mitre.org/groups/G1033) campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.(Citation: Microsoft Star Blizzard August 2022)(Citation: CISA Star Blizzard Advisory December 2023)(Citation: StarBlizzard)(Citation: Google TAG COLDRIVER January 2024) """ ; dcterms:title "Star Blizzard" ; dcterms:version "2.0" . attack-res:intrusion-set--afec6dc3-a18e-4b62-b1a4-5510e1a498d1 a attack:AdversaryGroup ; dcterms:description "[Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)" ; dcterms:title "Windshift" ; dcterms:version "1.1" . attack-res:intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c a attack:AdversaryGroup ; dcterms:description """[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019) [APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.(Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US District Court Indictment GRU Oct 2018) Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://attack.mitre.org/groups/G0034). """ ; dcterms:title "APT28" ; dcterms:version "5.3" . attack-res:intrusion-set--cc613a49-9bfa-4e22-98d1-15ffbb03f034 a attack:AdversaryGroup ; dcterms:description """[Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://attack.mitre.org/groups/G1006) has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some [Earth Lusca](https://attack.mitre.org/groups/G1006) operations may be financially motivated.(Citation: TrendMicro EarthLusca 2022) [Earth Lusca](https://attack.mitre.org/groups/G1006) has used malware commonly used by other Chinese threat groups, including [APT41](https://attack.mitre.org/groups/G0096) and the [Winnti Group](https://attack.mitre.org/groups/G0044) cluster, however security researchers assess [Earth Lusca](https://attack.mitre.org/groups/G1006)'s techniques and infrastructure are separate.(Citation: TrendMicro EarthLusca 2022)""" ; dcterms:title "Earth Lusca" ; dcterms:version "2.1" . attack-res:intrusion-set--d8bc9788-4f7d-41a9-9e9d-ee1ea18a8cf7 a attack:AdversaryGroup ; dcterms:description "[LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://attack.mitre.org/groups/G1004) specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.(Citation: BBC LAPSUS Apr 2022)(Citation: MSTIC DEV-0537 Mar 2022)(Citation: UNIT 42 LAPSUS Mar 2022)" ; dcterms:title "LAPSUS$" ; dcterms:version "2.1" . attack-res:intrusion-set--efed95ba-d7e8-47ff-8c53-99c42426ee7c a attack:AdversaryGroup ; dcterms:description "[PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. [PROMETHIUM](https://attack.mitre.org/groups/G0056) has demonstrated similarity to another activity group called [NEODYMIUM](https://attack.mitre.org/groups/G0055) due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)" ; dcterms:title "PROMETHIUM" ; dcterms:version "2.1" . attack-res:intrusion-set--f8cb7b36-62ef-4488-8a6d-a7033e3271c1 a attack:AdversaryGroup ; dcterms:description "[WIRTE](https://attack.mitre.org/groups/G0090) is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. [WIRTE](https://attack.mitre.org/groups/G0090) has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. [WIRTE](https://attack.mitre.org/groups/G0090) has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.(Citation: Lab52 WIRTE Apr 2019)(Citation: Kaspersky WIRTE November 2021)(Citation: Check Point Wirte NOV 2024)(Citation: Palo Alto Ashen Lepus DEC 2025)" ; dcterms:title "WIRTE" ; dcterms:version "3.0" . attack-res:malware--007ebf84-4e14-44c7-a5aa-151d5de85320 a attack:Malware, attack:Software ; dcterms:description "[CarbonSteal](https://attack.mitre.org/software/S0529) is one of a family of four surveillanceware tools that share a common C2 infrastructure. [CarbonSteal](https://attack.mitre.org/software/S0529) primarily deals with audio surveillance. (Citation: Lookout Uyghur Campaign)" ; dcterms:title "CarbonSteal" . attack-res:malware--037f44f0-0c07-4c7f-b40e-0325b5b228a9 a attack:Malware, attack:Software ; dcterms:description "[Cerberus](https://attack.mitre.org/software/S0480) is a banking trojan whose usage can be rented on underground forums and marketplaces. Prior to being available to rent, the authors of [Cerberus](https://attack.mitre.org/software/S0480) claim was used in private operations for two years.(Citation: Threat Fabric Cerberus)" ; dcterms:title "Cerberus" . attack-res:malware--05c4f87c-be8f-46ea-8d9a-2a0aad8f52c1 a attack:Malware, attack:Software ; dcterms:description "[DroidJack](https://attack.mitre.org/software/S0320) is an Android remote access tool that has been observed posing as legitimate applications including the Super Mario Run and Pokemon GO games. (Citation: Zscaler-SuperMarioRun) (Citation: Proofpoint-Droidjack)" ; dcterms:title "DroidJack" . attack-res:malware--0626c181-93cb-4860-9cb0-dff3b1c13063 a attack:Malware, attack:Software ; dcterms:description "[Rotexy](https://attack.mitre.org/software/S0411) is an Android banking malware that has evolved over several years. It was originally an SMS spyware Trojan first spotted in October 2014, and since then has evolved to contain more features, including ransomware functionality.(Citation: securelist rotexy 2018)" ; dcterms:title "Rotexy" . attack-res:malware--085eb36d-697d-4d9a-bac3-96eb879fe73c a attack:Malware, attack:Software ; dcterms:description "[Stealth Mango](https://attack.mitre.org/software/S0328) is Android malware that has reportedly been used to successfully compromise the mobile devices of government officials, members of the military, medical professionals, and civilians. The iOS malware known as [Tangelo](https://attack.mitre.org/software/S0329) is believed to be from the same developer. (Citation: Lookout-StealthMango)" ; dcterms:title "Stealth Mango" . attack-res:malware--08784a9d-09e9-4dce-a839-9612398214e8 a attack:Malware, attack:Software ; dcterms:description "[Allwinner](https://attack.mitre.org/software/S0319) is a company that supplies processors used in Android tablets and other devices. A Linux kernel distributed by [Allwinner](https://attack.mitre.org/software/S0319) for use on these devices reportedly contained a backdoor. (Citation: HackerNews-Allwinner)" ; dcterms:title "Allwinner" . attack-res:malware--0b9c5d11-651a-4378-b129-5c584d0242c5 a attack:Malware, attack:Software ; dcterms:description "[GoldenEagle](https://attack.mitre.org/software/S0551) is a piece of Android malware that has been used in targeting of Uyghurs, Muslims, Tibetans, individuals in Turkey, and individuals in China. Samples have been found as early as 2012.(Citation: Lookout Uyghur Campaign)" ; dcterms:title "GoldenEagle" . attack-res:malware--0ec9593f-3221-49b1-b597-37f307c19f13 a attack:Malware, attack:Software ; dcterms:description "[FlixOnline](https://attack.mitre.org/software/S1103) is an Android malware, first detected in early 2021, believed to target users of WhatsApp. [FlixOnline](https://attack.mitre.org/software/S1103) primarily spreads via automatic replies to a device’s incoming WhatsApp messages.(Citation: checkpoint_flixonline_0421) " ; dcterms:title "FlixOnline" . attack-res:malware--108b2817-bc01-404e-8e1b-8cdeec846326 a attack:Malware, attack:Software ; dcterms:description "[Bread](https://attack.mitre.org/software/S0432) was a large-scale billing fraud malware family known for employing many different cloaking and obfuscation techniques in an attempt to continuously evade Google Play Store’s malware detection. 1,700 unique Bread apps were detected and removed from the Google Play Store before being downloaded by users.(Citation: Google Bread)" ; dcterms:title "Bread" . attack-res:malware--1393fb21-d09f-4ce8-96cf-1bcc9881765f a attack:Malware, attack:Software ; dcterms:description "[TriangleDB](https://attack.mitre.org/software/S1216) is an Objective-C written implant deployed after [Binary Validator](https://attack.mitre.org/software/S1215) and after root privileges are obtained during [Operation Triangulation](https://attack.mitre.org/campaigns/C0054)’s infection chain. Upon execution, [TriangleDB](https://attack.mitre.org/software/S1216) communicates with the C2 server, relaying information about the victim device.(Citation: SecureList OpTriangulation 21Jun2023) " ; dcterms:title "TriangleDB" . attack-res:malware--15d78a95-af6a-4b06-8dae-76bedb0ec5a1 a attack:Malware, attack:Software ; dcterms:description "[Hornbill](https://attack.mitre.org/software/S1077) is one of two mobile malware families known to be used by the APT [Confucius](https://attack.mitre.org/groups/G0142). Analysis suggests that [Hornbill](https://attack.mitre.org/software/S1077) was first active in early 2018. While [Hornbill](https://attack.mitre.org/software/S1077) and [Sunbird](https://attack.mitre.org/software/S1082) overlap in core capabilities, [Hornbill](https://attack.mitre.org/software/S1077) has tools and behaviors suggesting more passive reconnaissance.(Citation: lookout_hornbill_sunbird_0221)" ; dcterms:title "Hornbill" . attack-res:malware--172444ab-97fc-4d94-b142-179452bfb760 a attack:Malware, attack:Software ; dcterms:description "[Judy](https://attack.mitre.org/software/S0325) is auto-clicking adware that was distributed through multiple apps in the Google Play Store. (Citation: CheckPoint-Judy)" ; dcterms:title "Judy" . attack-res:malware--2074b2ad-612e-4758-adce-7901c1b49bbc a attack:Malware, attack:Software ; dcterms:description "[OldBoot](https://attack.mitre.org/software/S0285) is an Android malware family. (Citation: HackerNews-OldBoot)" ; dcterms:title "OldBoot" . attack-res:malware--20945359-3b39-4542-85ef-08ecb4e1c174 a attack:Malware, attack:Software ; dcterms:description "[StrongPity](https://attack.mitre.org/software/S0491) is an information stealing malware used by [PROMETHIUM](https://attack.mitre.org/groups/G0056).(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)" ; dcterms:title "StrongPity" . attack-res:malware--20d56cd6-8dff-4871-9889-d32d254816de a attack:Malware, attack:Software ; dcterms:description "[Gooligan](https://attack.mitre.org/software/S0290) is a malware family that runs privilege escalation exploits on Android devices and then uses its escalated privileges to steal authentication tokens that can be used to access data from many Google applications. [Gooligan](https://attack.mitre.org/software/S0290) has been described as part of the Ghost Push Android malware family. (Citation: Gooligan Citation) (Citation: Ludwig-GhostPush) (Citation: Lookout-Gooligan)" ; dcterms:title "Gooligan" . attack-res:malware--20dbaf05-59b8-4dc6-8777-0b17f4553a23 a attack:Malware, attack:Software ; dcterms:description "[SpyNote RAT](https://attack.mitre.org/software/S0305) (Remote Access Trojan) is a family of malicious Android apps. The [SpyNote RAT](https://attack.mitre.org/software/S0305) builder tool can be used to develop malicious apps with the malware's functionality. (Citation: Zscaler-SpyNote)" ; dcterms:title "SpyNote RAT" . attack-res:malware--21170624-89db-4e99-bf27-58d26be07c3a a attack:Malware, attack:Software ; dcterms:description """[TrickMo](https://attack.mitre.org/software/S0427) a 2FA bypass mobile banking trojan, most likely being distributed by [TrickBot](https://attack.mitre.org/software/S0266). [TrickMo](https://attack.mitre.org/software/S0427) has been primarily targeting users located in Germany.(Citation: SecurityIntelligence TrickMo) [TrickMo](https://attack.mitre.org/software/S0427) is designed to steal transaction authorization numbers (TANs), which are typically used as one-time passwords.(Citation: SecurityIntelligence TrickMo) """ ; dcterms:title "TrickMo" . attack-res:malware--21b7e0b0-0dea-4ccc-8ad4-8da51fe3a901 a attack:Malware, attack:Software ; dcterms:description "[INSOMNIA](https://attack.mitre.org/software/S0463) is spyware that has been used by the group Evil Eye.(Citation: Volexity Insomnia)" ; dcterms:title "INSOMNIA" . attack-res:malware--22b596a6-d288-4409-8520-5f2846f85514 a attack:Malware, attack:Software ; dcterms:description "[Dvmap](https://attack.mitre.org/software/S0420) is rooting malware that injects malicious code into system runtime libraries. It is credited with being the first malware that performs this type of code injection.(Citation: SecureList DVMap June 2017)" ; dcterms:title "Dvmap" . attack-res:malware--22faaa56-a8ac-4292-9be6-b571b255ee40 a attack:Malware, attack:Software ; dcterms:description "[Zen](https://attack.mitre.org/software/S0494) is Android malware that was first seen in 2013.(Citation: Google Security Zen)" ; dcterms:title "Zen" . attack-res:malware--23040c15-e7d8-47b5-8c16-8fd3e0e297fe a attack:Malware, attack:Software ; dcterms:description "[NotCompatible](https://attack.mitre.org/software/S0299) is an Android malware family that was used between at least 2014 and 2016. It has multiple variants that have become more sophisticated over time. (Citation: Lookout-NotCompatible)" ; dcterms:title "NotCompatible" . attack-res:malware--24c8f6db-71e0-41ef-a1dc-83399a5b17e5 a attack:Malware, attack:Software ; dcterms:description "[AhRat](https://attack.mitre.org/software/S1095) is an Android remote access tool based on the open-source AhMyth remote access tool. [AhRat](https://attack.mitre.org/software/S1095) initially spread in August 2022 on the Google Play Store via an update containing malicious code to the previously benign application, “iRecorder – Screen Recorder,” which itself was released in September 2021.(Citation: welivesecurity_ahrat_0523)" ; dcterms:title "AhRat" . attack-res:malware--2740eaf6-2db2-4a40-a63f-f5b166c7059c a attack:Malware, attack:Software ; dcterms:description "[XLoader for Android](https://attack.mitre.org/software/S0318) is a malicious Android app first observed targeting Japan, Korea, China, Taiwan, and Hong Kong in 2018. It has more recently been observed targeting South Korean users as a pornography application.(Citation: TrendMicro-XLoader-FakeSpy)(Citation: TrendMicro-XLoader) It is tracked separately from the [XLoader for iOS](https://attack.mitre.org/software/S0490)." ; dcterms:title "XLoader for Android" . attack-res:malware--28e39395-91e7-4f02-b694-5e079c964da9 a attack:Malware, attack:Software ; dcterms:description "[Trojan-SMS.AndroidOS.FakeInst.a](https://attack.mitre.org/software/S0306) is Android malware. (Citation: Kaspersky-MobileMalware)" ; dcterms:title "Trojan-SMS.AndroidOS.FakeInst.a" . attack-res:malware--29944858-da52-4d3d-b428-f8a6eb8dde6f a attack:Malware, attack:Software ; dcterms:description "[XLoader for iOS](https://attack.mitre.org/software/S0490) is a malicious iOS application that is capable of gathering system information.(Citation: TrendMicro-XLoader-FakeSpy) It is tracked separately from the [XLoader for Android](https://attack.mitre.org/software/S0318)." ; dcterms:title "XLoader for iOS" . attack-res:malware--2aec175b-4429-4048-8e09-3ef6cbecfc64 a attack:Malware, attack:Software ; dcterms:description "[AbstractEmu](https://attack.mitre.org/software/S1061) is mobile malware that was first seen in Google Play and other third-party stores in October 2021. It was discovered in 19 Android applications, of which at least 7 abused known Android exploits for obtaining root permissions. [AbstractEmu](https://attack.mitre.org/software/S1061) was observed primarily impacting users in the United States, however victims are believed to be across a total of 17 countries.(Citation: lookout_abstractemu_1021)" ; dcterms:title "AbstractEmu" . attack-res:malware--2cf00c5a-857d-4cb6-8f03-82f15bee0f6f a attack:Malware, attack:Software ; dcterms:description "[Chameleon](https://attack.mitre.org/software/S1083) is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, [Chameleon](https://attack.mitre.org/software/S1083) has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of [Chameleon](https://attack.mitre.org/software/S1083) has expanded its targets to include Android users in the United Kingdom and Italy.(Citation: cyble_chameleon_0423)(Citation: ThreatFabric_Chameleon_Dec2023) " ; dcterms:title "Chameleon" . attack-res:malware--3049b2f2-e323-4cdb-91cb-13b37b904cbb a attack:Malware, attack:Software ; dcterms:description "[Exodus](https://attack.mitre.org/software/S0405) is Android spyware deployed in two distinct stages named Exodus One (dropper) and Exodus Two (payload).(Citation: SWB Exodus March 2019)" ; dcterms:title "Exodus" . attack-res:malware--317a2c10-d489-431e-b6b2-f0251fddc88e a attack:Malware, attack:Software ; dcterms:description "[Dendroid](https://attack.mitre.org/software/S0301) is an Android remote access tool (RAT) primarily targeting Western countries. The RAT was available for purchase for $300 and came bundled with a utility to inject the RAT into legitimate applications.(Citation: Lookout-Dendroid)" ; dcterms:title "Dendroid" . attack-res:malware--326eaf7b-5784-4f08-8fc2-61fd5d5bc5fb a attack:Malware, attack:Software ; dcterms:description "[WireLurker](https://attack.mitre.org/software/S0312) is a family of macOS malware that targets iOS devices connected over USB. (Citation: PaloAlto-WireLurker)" ; dcterms:title "WireLurker" . attack-res:malware--3271c107-92c4-442e-9506-e76d62230ee8 a attack:Malware, attack:Software ; dcterms:description """[Desert Scorpion](https://attack.mitre.org/software/S0505) is surveillanceware that has targeted the Middle East, specifically individuals located in Palestine. [Desert Scorpion](https://attack.mitre.org/software/S0505) is suspected to have been operated by the threat actor [APT-C-23](https://attack.mitre.org/groups/G1028).(Citation: Lookout Desert Scorpion) There are multiple close variants of [Desert Scorpion](https://attack.mitre.org/software/S0505), such as VAMP(Citation: Unit42 VAMP 2017), GnatSpy(Citation: Trendmicro GnatSpy 2017), [FrozenCell](https://attack.mitre.org/software/S0577) and [SpyC23](https://attack.mitre.org/software/S1195), which add some additional functionality but are not significantly different from the original malware.""" ; dcterms:title "Desert Scorpion" . attack-res:malware--33d9d91d-aad9-49d5-a516-220ce101ac8a a attack:Malware, attack:Software ; dcterms:description "[Pegasus for iOS](https://attack.mitre.org/software/S0289) is the iOS version of malware that has reportedly been linked to the NSO Group. It has been advertised and sold to target high-value victims.(Citation: Lookout-Pegasus)(Citation: PegasusCitizenLab) The Android version is tracked separately under [Pegasus for Android](https://attack.mitre.org/software/S0316)." ; dcterms:title "Pegasus for iOS" . attack-res:malware--35aae10a-97c5-471a-9c67-02c231a7a31a a attack:Malware, attack:Software ; dcterms:description "[Tangelo](https://attack.mitre.org/software/S0329) is iOS malware that is believed to be from the same developers as the [Stealth Mango](https://attack.mitre.org/software/S0328) Android malware. It is not a mobile application, but rather a Debian package that can only run on jailbroken iOS devices. (Citation: Lookout-StealthMango)" ; dcterms:title "Tangelo" . attack-res:malware--363bc05d-13cb-4e98-a5b7-e250f2bbdc2b a attack:Malware, attack:Software ; dcterms:description "[RCSAndroid](https://attack.mitre.org/software/S0295) is Android malware. (Citation: TrendMicro-RCSAndroid)" ; dcterms:title "RCSAndroid" . attack-res:malware--366c800f-97a8-48d5-b0a6-79d00198252a a attack:Malware, attack:Software ; dcterms:description "[Corona Updates](https://attack.mitre.org/software/S0425) is Android spyware that took advantage of the Coronavirus pandemic. The campaign distributing this spyware is tracked as Project Spy. Multiple variants of this spyware have been discovered to have been hosted on the Google Play Store.(Citation: TrendMicro Coronavirus Updates)" ; dcterms:title "Corona Updates" . attack-res:malware--3a913bac-4fae-4d0e-bca8-cae452f1599b a attack:Malware, attack:Software ; dcterms:description "[Skygofree](https://attack.mitre.org/software/S0327) is Android spyware that is believed to have been developed in 2014 and used through at least 2017. (Citation: Kaspersky-Skygofree)" ; dcterms:title "Skygofree" . attack-res:malware--3bc1f0ad-ef11-4afc-83c0-fcffe08d4e50 a attack:Malware, attack:Software ; dcterms:description "[KeyRaider](https://attack.mitre.org/software/S0288) is malware that steals Apple account credentials and other data from jailbroken iOS devices. It also has ransomware functionality. (Citation: Xiao-KeyRaider)" ; dcterms:title "KeyRaider" . attack-res:malware--3c3b55a6-c3e9-4043-8aae-283fe96220c0 a attack:Malware, attack:Software ; dcterms:description "[ZergHelper](https://attack.mitre.org/software/S0287) is iOS riskware that was unique due to its apparent evasion of Apple's App Store review process. No malicious functionality was identified in the app, but it presents security risks. (Citation: Xiao-ZergHelper)" ; dcterms:title "ZergHelper" . attack-res:malware--3cf81957-489a-469f-b013-362d548a96c1 a attack:Malware, attack:Software ; dcterms:description "[CherryBlos](https://attack.mitre.org/software/S1225) is an Android malware that steals credentials and redirects cryptocurrency to adversary-controlled wallets. [CherryBlos](https://attack.mitre.org/software/S1225) was labelled Robot 999 in its first appearance in April 2023; since then, various aliases have been used, including GPTalk, Happy Miner, and SynthNet. The threat actors behind [CherryBlos](https://attack.mitre.org/software/S1225) uploaded the malware to different Google Play regions, such as Malaysia, Vietnam, Indonesia, Philippines, Uganda, and Mexico.(Citation: TrendMicro_CherryBlos_July2023) " ; dcterms:title "CherryBlos" . attack-res:malware--3d6c4389-3489-40a3-beda-c56e650b6f68 a attack:Malware, attack:Software ; dcterms:description "[DoubleAgent](https://attack.mitre.org/software/S0550) is a family of RAT malware dating back to 2013, known to target groups with contentious relationships with the Chinese government.(Citation: Lookout Uyghur Campaign)" ; dcterms:title "DoubleAgent" . attack-res:malware--3dbef387-12df-4547-9dd3-075c7ffec9e3 a attack:Malware, attack:Software ; dcterms:description "[DocSwap](https://attack.mitre.org/software/S9005) is an Android malware first identified in 2025, and attributed to [Kimsuky](https://attack.mitre.org/groups/G0094). [DocSwap](https://attack.mitre.org/software/S9005)’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on [DocSwap](https://attack.mitre.org/software/S9005)’s name and Korean-language strings, [DocSwap](https://attack.mitre.org/software/S9005) potentially targets mobile device users in South Korea. Several variants of [DocSwap](https://attack.mitre.org/software/S9005) exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.(Citation: EnkiWhiteHat_KimsukyDOCSWAP_Dec2025)(Citation: S2W_DocSwap_Mar2025) " ; dcterms:title "DocSwap" . attack-res:malware--41e3fd01-7b83-471f-835d-d2b1dc9a770c a attack:Malware, attack:Software ; dcterms:description "[Twitoor](https://attack.mitre.org/software/S0302) is a dropper application capable of receiving commands from social media.(Citation: ESET-Twitoor)" ; dcterms:title "Twitoor" . attack-res:malware--429e1526-6293-495b-8808-af7f9a66c4be a attack:Malware, attack:Software ; dcterms:description "[Fakecalls](https://attack.mitre.org/software/S1080) is an Android trojan, first detected in January 2021, that masquerades as South Korean banking apps. It has capabilities to intercept calls to banking institutions and even maintain realistic dialogues with the victim using pre-recorded audio snippets.(Citation: kaspersky_fakecalls_0422) " ; dcterms:title "Fakecalls" . attack-res:malware--4b53eb01-57d7-47b4-b078-22766b002b36 a attack:Malware, attack:Software ; dcterms:description "[S.O.V.A.](https://attack.mitre.org/software/S1062) is an Android banking trojan that was first identified in August 2021 and has subsequently been found in a variety of applications, including banking, cryptocurrency wallet/exchange, and shopping apps. [S.O.V.A.](https://attack.mitre.org/software/S1062), which is Russian for \"owl\", contains features not commonly found in Android malware, such as session cookie theft.(Citation: threatfabric_sova_0921)(Citation: cleafy_sova_1122)" ; dcterms:title "S.O.V.A." . attack-res:malware--4bf6ba32-4165-42c1-b911-9c36165891c8 a attack:Malware, attack:Software ; dcterms:description "[ANDROIDOS_ANSERVER.A](https://attack.mitre.org/software/S0310) is Android malware that is unique because it uses encrypted content within a blog site for command and control. (Citation: TrendMicro-Anserver)" ; dcterms:title "ANDROIDOS_ANSERVER.A" . attack-res:malware--4e164a21-3fbe-4aaa-be69-2513fdba90f7 a attack:Malware, attack:Software ; dcterms:description "[SameCoin](https://attack.mitre.org/software/S9030) is a multi-platform wiper with Windows and Android versions that has been used by [WIRTE](https://attack.mitre.org/groups/G0090) to target entities in the Middle East including in Israel.(Citation: Check Point Wirte NOV 2024)" ; dcterms:title "SameCoin" . attack-res:malware--507fe748-5e4a-4b45-9e9f-8b1115f4e878 a attack:Malware, attack:Software ; dcterms:description "[DualToy](https://attack.mitre.org/software/S0315) is Windows malware that installs malicious applications onto Android and iOS devices connected over USB. (Citation: PaloAlto-DualToy)" ; dcterms:title "DualToy" . attack-res:malware--52c994fa-b6c8-45a8-9586-a4275cf19307 a attack:Malware, attack:Software ; dcterms:description """[Mandrake](https://attack.mitre.org/software/S0485) is a sophisticated Android espionage platform that has been active in the wild since at least 2016. [Mandrake](https://attack.mitre.org/software/S0485) is very actively maintained, with sophisticated features and attacks that are executed with surgical precision. [Mandrake](https://attack.mitre.org/software/S0485) has gone undetected for several years by providing legitimate, ad-free applications with social media and real reviews to back the apps. The malware is only activated when the operators issue a specific command.(Citation: Bitdefender Mandrake)""" ; dcterms:title "Mandrake" . attack-res:malware--55714f87-6178-4b89-b3e5-d3a643f647ca a attack:Malware, attack:Software ; dcterms:description "[HilalRAT](https://attack.mitre.org/software/S1128) is a remote access-capable Android malware, developed and used by [UNC788](https://attack.mitre.org/groups/G1029).(Citation: Meta Adversarial Threat Report 2022) [HilalRAT](https://attack.mitre.org/software/S1128) is capable of collecting data, such as device location, call logs, etc., and is capable of executing actions, such as activating a device's camera and microphone.(Citation: Meta Adversarial Threat Report 2022) " ; dcterms:title "HilalRAT" . attack-res:malware--56660521-6db4-4e5a-a927-464f22954b7c a attack:Malware, attack:Software ; dcterms:description "[X-Agent for Android](https://attack.mitre.org/software/S0314) is Android malware that was placed in a repackaged version of a Ukrainian artillery targeting application. The malware reportedly retrieved general location data on where the victim device was used, and therefore could likely indicate the potential location of Ukrainian artillery. (Citation: CrowdStrike-Android) Is it tracked separately from the [CHOPSTICK](https://attack.mitre.org/software/S0023)." ; dcterms:title "X-Agent for Android" . attack-res:malware--5a5dca4c-03c1-4b99-bfcf-c206e20aa663 a attack:Malware, attack:Software ; dcterms:description "[DEFENSOR ID](https://attack.mitre.org/software/S0479) is a banking trojan capable of clearing a victim’s bank account or cryptocurrency wallet and taking over email or social media accounts. [DEFENSOR ID](https://attack.mitre.org/software/S0479) performs the majority of its malicious functionality by abusing Android’s accessibility service.(Citation: ESET DEFENSOR ID) " ; dcterms:title "DEFENSOR ID" . attack-res:malware--5aff44ab-5a41-49bb-b5d1-b4876d0437f4 a attack:Malware, attack:Software ; dcterms:description "[BRATA](https://attack.mitre.org/software/S1094) (Brazilian Remote Access Tool, Android), is an evolving Android malware strain, detected in late 2018 and again in late 2021. Originating in Brazil, [BRATA](https://attack.mitre.org/software/S1094) was later also found in the UK, Poland, Italy, Spain, and USA, where it is believed to have targeted financial institutions such as banks. There are currently three known variants of [BRATA](https://attack.mitre.org/software/S1094).(Citation: securelist_brata_0819)(Citation: cleafy_brata_0122)(Citation: mcafee_brata_0421)" ; dcterms:title "BRATA" . attack-res:malware--5b5d1e6c-e7de-4b46-ab8f-8556e8745927 a attack:Malware, attack:Software ; dcterms:description "First observed in 2018, LightSpy is a modular malware family that initially targeted iOS devices in Southern Asia before expanding to Android and macOS platforms. It consists of a downloader, a main executable that manages network communications, and functionality-specific modules, typically implemented as `.dylib` files (iOS, macOS) or `.apk` files (Android). LightSpy can collect VoIP call recordings, SMS messages, and credential stores, which are then exfiltrated to a command and control (C2) server.(Citation: MelikovBlackBerry LightSpy 2024) " ; dcterms:title "LightSpy" . attack-res:malware--5ddf81ea-2c06-497b-8c30-5f1ab89a40f9 a attack:Malware, attack:Software ; dcterms:description "[MazarBOT](https://attack.mitre.org/software/S0303) is Android malware that was distributed via SMS in Denmark in 2016. (Citation: Tripwire-MazarBOT)" ; dcterms:title "MazarBOT" . attack-res:malware--6146be90-470c-4049-bb3a-9986b8ffb65b a attack:Malware, attack:Software ; dcterms:description "[Ginp](https://attack.mitre.org/software/S0423) is an Android banking trojan that has been used to target Spanish banks. Some of the code was taken directly from [Anubis](https://attack.mitre.org/software/S0422).(Citation: ThreatFabric Ginp)" ; dcterms:title "Ginp" . attack-res:malware--6447e3a1-ef4d-44b1-99d5-6b1c4888674f a attack:Malware, attack:Software ; dcterms:description "[HummingWhale](https://attack.mitre.org/software/S0321) is an Android malware family that performs ad fraud. (Citation: ArsTechnica-HummingWhale)" ; dcterms:title "HummingWhale" . attack-res:malware--680f680c-eef9-4f8a-b5f5-f451bf47e403 a attack:Malware, attack:Software ; dcterms:description "[eSurv](https://attack.mitre.org/software/S0507) is mobile surveillanceware designed for the lawful intercept market that was developed over the course of many years.(Citation: Lookout eSurv)" ; dcterms:title "eSurv" . attack-res:malware--68156e5a-4c3a-46dd-9c5e-c0bfdec6651f a attack:Malware, attack:Software ; dcterms:description "[TangleBot](https://attack.mitre.org/software/S1069) is SMS malware that was initially observed in September 2021, primarily targeting mobile users in the United States and Canada. [TangleBot](https://attack.mitre.org/software/S1069) has used SMS text message lures about COVID-19 regulations and vaccines to trick mobile users into downloading the malware, similar to [FluBot](https://attack.mitre.org/software/S1067) Android malware campaigns.(Citation: cloudmark_tanglebot_0921)" ; dcterms:title "TangleBot" . attack-res:malware--6a7aaab1-3e0a-48bb-ba66-bbf7665c0a65 a attack:Malware, attack:Software ; dcterms:description "[Monokle](https://attack.mitre.org/software/S0407) is targeted, sophisticated mobile surveillanceware. It is developed for Android, but there are some code artifacts that suggests an iOS version may be in development.(Citation: Lookout-Monokle)" ; dcterms:title "Monokle" . attack-res:malware--6ceb0644-0ae9-4ee1-a659-3888687cb03b a attack:Malware, attack:Software ; dcterms:description "[RatMilad](https://attack.mitre.org/software/S1241) is an Android remote access tool (RAT) with spyware functionality that has been used to target enterprise mobile devices in the Middle East since at least 2021. Variants of [RatMilad](https://attack.mitre.org/software/S1241) have been disguised as VPN applications and a fake app named NumRent. Upon installation, [RatMilad](https://attack.mitre.org/software/S1241) employs multiple [Collection](https://attack.mitre.org/tactics/TA0035) techniques to collect sensitive information before uploading the collected data to its command and control (C2) server. (Citation: ZimperiumGupta_RatMilad_Oct2022)" ; dcterms:title "RatMilad" . attack-res:malware--6d5c257d-e6de-4c95-a7e8-09ac9386007d a attack:Malware, attack:Software ; dcterms:description "[DCHSpy](https://attack.mitre.org/software/S1243) is an Android spyware likely used by [MuddyWater](https://attack.mitre.org/groups/G0069). [DCHSpy](https://attack.mitre.org/software/S1243) uses political decoys and masquerades as legitimate applications, such as VPNs and banking applications, to trick victims into downloading the malware. Once downloaded, [DCHSpy](https://attack.mitre.org/software/S1243) collects information from the device and exfiltrates the data to the command and control (C2) server.(Citation: Lookout_DCHSpy_July2025) " ; dcterms:title "DCHSpy" . attack-res:malware--6e282bbf-5f32-476a-b879-ba77eec463c8 a attack:Malware, attack:Software ; dcterms:description "[Red Alert 2.0](https://attack.mitre.org/software/S0539) is a banking trojan that masquerades as a VPN client.(Citation: Sophos Red Alert 2.0) " ; dcterms:title "Red Alert 2.0" . attack-res:malware--6fcaf9b0-b509-4644-9f93-556222c81ed2 a attack:Malware, attack:Software ; dcterms:description "[ViceLeaker](https://attack.mitre.org/software/S0418) is a spyware framework, capable of extensive surveillance and data exfiltration operations, primarily targeting devices belonging to Israeli citizens.(Citation: SecureList - ViceLeaker 2019)(Citation: Bitdefender - Triout 2018)" ; dcterms:title "ViceLeaker" . attack-res:malware--8205a875-3ed5-4be2-ab9b-14a7d29431d0 a attack:Malware, attack:Software ; dcterms:description "[VajraSpy](https://attack.mitre.org/software/S9006) is Android malware distributed via trojanized messaging and news applications. It has been used to target individuals in Pakistan and India since at least 2021 and has been delivered through the Google Play Store, malicious domains, and other uncontrolled distribution channels. [VajraSpy](https://attack.mitre.org/software/S9006) is attributed with high confidence to [Patchwork](https://attack.mitre.org/groups/G0040) which has used the malware to conduct targeted espionage, primarily against devices in Pakistan.(Citation: ESET_VajraSpy_Feb2024)(Citation: ArcticWolf_DroppingElephant_July2025)(Citation: K7Dhanalakshmi_VajraSpy_April2022) " ; dcterms:title "VajraSpy" . attack-res:malware--8338393c-cb2e-4ee6-b944-34672499c785 a attack:Malware, attack:Software ; dcterms:description "[FlyTrap](https://attack.mitre.org/software/S1093) is an Android trojan, first detected in March 2021, that uses social engineering tactics to compromise Facebook accounts. [FlyTrap](https://attack.mitre.org/software/S1093) was initially detected through infected apps on the Google Play store, and is believed to have impacted over 10,000 victims across at least 140 countries.(Citation: Trend Micro FlyTrap) " ; dcterms:title "FlyTrap" . attack-res:malware--838f647e-8ff8-48bd-bbd5-613cee7736cb a attack:Malware, attack:Software ; dcterms:description "[FakeSpy](https://attack.mitre.org/software/S0509) is Android spyware that has been operated by the Chinese threat actor behind the Roaming Mantis campaigns.(Citation: Cybereason FakeSpy)" ; dcterms:title "FakeSpy" . attack-res:malware--86fc6f0c-86d9-473e-89f3-f50f3cb9319b a attack:Malware, attack:Software ; dcterms:description "[SpyDealer](https://attack.mitre.org/software/S0324) is Android malware that exfiltrates sensitive data from Android devices. (Citation: PaloAlto-SpyDealer)" ; dcterms:title "SpyDealer" . attack-res:malware--89c3dbf6-f281-41b7-be1d-a0e641014853 a attack:Malware, attack:Software ; dcterms:description "[Concipit1248](https://attack.mitre.org/software/S0426) is iOS spyware that was discovered using the same name as the developer of the Android spyware [Corona Updates](https://attack.mitre.org/software/S0425). Further investigation revealed that the two pieces of software contained the same C2 URL and similar functionality.(Citation: TrendMicro Coronavirus Updates)" ; dcterms:title "Concipit1248" . attack-res:malware--936be60d-90eb-4c36-9247-4b31128432c4 a attack:Malware, attack:Software ; dcterms:description "[RuMMS](https://attack.mitre.org/software/S0313) is an Android malware family. (Citation: FireEye-RuMMS)" ; dcterms:title "RuMMS" . attack-res:malware--93799a9d-3537-43d8-b6f4-17215de1657c a attack:Malware, attack:Software ; dcterms:description "[Pegasus for Android](https://attack.mitre.org/software/S0316) is the Android version of malware that has reportedly been linked to the NSO Group. (Citation: Lookout-PegasusAndroid) (Citation: Google-Chrysaor) The iOS version is tracked separately under [Pegasus for iOS](https://attack.mitre.org/software/S0289)." ; dcterms:title "Pegasus for Android" . attack-res:malware--95811c0a-abe0-4e7f-a0cc-b0662ced5807 a attack:Malware, attack:Software ; dcterms:description """[SpyC23](https://attack.mitre.org/software/S1195) is a mobile malware that has been used by [APT-C-23](https://attack.mitre.org/groups/G1028) since at least 2017. [SpyC23](https://attack.mitre.org/software/S1195) has been observed primarily targeting Android devices in the Middle East.(Citation: welivesecurity_apt-c-23) There are multiple close variants of [SpyC23](https://attack.mitre.org/software/S1195), such as VAMP(Citation: Unit42 VAMP 2017), GnatSpy(Citation: Trendmicro GnatSpy 2017), [Desert Scorpion](https://attack.mitre.org/software/S0505) and [FrozenCell](https://attack.mitre.org/software/S0577), which add some additional functionality but are not significantly different from the original malware.""" ; dcterms:title "SpyC23" . attack-res:malware--96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62 a attack:Malware, attack:Software ; dcterms:description """[FrozenCell](https://attack.mitre.org/software/S0577) is the mobile component of a family of surveillanceware, with a corresponding desktop component known as KasperAgent and [Micropsia](https://attack.mitre.org/software/S0339).(Citation: Lookout FrozenCell) There are multiple close variants of [FrozenCell](https://attack.mitre.org/software/S0577), such as VAMP(Citation: Unit42 VAMP 2017), GnatSpy(Citation: Trendmicro GnatSpy 2017), [Desert Scorpion](https://attack.mitre.org/software/S0505) and [SpyC23](https://attack.mitre.org/software/S1195), which add some additional functionality but are not significantly different from the original malware.""" ; dcterms:title "FrozenCell" . attack-res:malware--9a3315e6-667d-4b64-b789-5e01653110a5 a attack:Malware, attack:Software ; dcterms:description """[NGate](https://attack.mitre.org/software/S9040) is an Android malware that was first seen in November 2023 targeting Czech banks and Polish banks. [NGate](https://attack.mitre.org/software/S9040) uses Near Field Communication (NFC) to relay a victim’s debit card and banking information from the compromised Android device to the adversary’s device, ultimately resulting in fraudulent ATM withdrawals by the adversary. [NGate](https://attack.mitre.org/software/S9040) uses the legitimate tool called NFCGate, developed by students at the Technical University of Darmstadt, Germany.(Citation: ESETStefankoOsmani_NGate_Aug2024)(Citation: CERTPL_NGate_Nov2025) A new variant of [NGate](https://attack.mitre.org/software/S9040) that abuses the legitimate application HandyPay, potentially with AI-generated code, has been observed targeting users in Brazil since at least November 2025. This variant is capable of performing NFC transfers like previous iterations with new functionality for capturing and exfiltrating the victim’s payment card PIN.(Citation: ESETStefanko_NGateVariant_Apr2026) """ ; dcterms:title "NGate" . attack-res:malware--9b86f8c3-33ab-44cf-a66d-c0fd6070e2ce a attack:Malware, attack:Software ; dcterms:description "[AndroidOS/MalLocker.B](https://attack.mitre.org/software/S0524) is a variant of a ransomware family targeting Android devices. It prevents the user from interacting with the UI by displaying a screen containing a ransom note over all other windows. (Citation: Microsoft MalLockerB)" ; dcterms:title "AndroidOS/MalLocker.B" . attack-res:malware--9cd72f5c-bec0-4f7e-bb6d-296937116291 a attack:Malware, attack:Software ; dcterms:description "[SharkBot](https://attack.mitre.org/software/S1055) is a banking malware, first discovered in October 2021, that tries to initiate money transfers directly from compromised devices by abusing Accessibility Services.(Citation: nccgroup_sharkbot_0322)" ; dcterms:title "SharkBot" . attack-res:malware--9ed10b5a-ff20-467f-bf2f-d3fbf763e381 a attack:Malware, attack:Software ; dcterms:description "[RedDrop](https://attack.mitre.org/software/S0326) is an Android malware family that exfiltrates sensitive data from devices. (Citation: Wandera-RedDrop)" ; dcterms:title "RedDrop" . attack-res:malware--a0d774e4-bafc-4292-8651-3ec899391341 a attack:Malware, attack:Software ; dcterms:description "[CHEMISTGAMES](https://attack.mitre.org/software/S0555) is a modular backdoor that has been deployed by [Sandworm Team](https://attack.mitre.org/groups/G0034).(Citation: CYBERWARCON CHEMISTGAMES)" ; dcterms:title "CHEMISTGAMES" . attack-res:malware--a15c9357-2be0-4836-beec-594f28b9b4a9 a attack:Malware, attack:Software ; dcterms:description "[YiSpecter](https://attack.mitre.org/software/S0311) is a family of iOS and Android malware, first detected in November 2014, targeting users in mainland China and Taiwan. [YiSpecter](https://attack.mitre.org/software/S0311) abuses private APIs in iOS to infect both jailbroken and non-jailbroken devices.(Citation: paloalto_yispecter_1015)" ; dcterms:title "YiSpecter" . attack-res:malware--a1867c56-8c86-455a-96ad-b0d5f7e2bc17 a attack:Malware, attack:Software ; dcterms:description "[Trojan-SMS.AndroidOS.Agent.ao](https://attack.mitre.org/software/S0307) is Android malware. (Citation: Kaspersky-MobileMalware)" ; dcterms:title "Trojan-SMS.AndroidOS.Agent.ao" . attack-res:malware--a2ee7d2d-fb45-44f3-8f67-9921c7810db1 a attack:Malware, attack:Software ; dcterms:description "[BOULDSPY](https://attack.mitre.org/software/S1079) is an Android malware, detected in early 2023, with surveillance and remote-control capabilities. Analysis of exfiltrated C2 data suggests that [BOULDSPY](https://attack.mitre.org/software/S1079) primarily targeted minority groups in Iran.(Citation: lookout_bouldspy_0423)" ; dcterms:title "BOULDSPY" . attack-res:malware--a3c59d82-2c7c-44e5-a869-68e0a3e5935e a attack:Malware, attack:Software ; dcterms:description "[Anubis](https://attack.mitre.org/software/S0422) is Android malware that was originally used for cyber espionage, and has been retooled as a banking trojan.(Citation: Cofense Anubis)" ; dcterms:title "Anubis" . attack-res:malware--a3dad2be-ce62-4440-953b-00fbce7aba93 a attack:Malware, attack:Software ; dcterms:description "[AndroRAT](https://attack.mitre.org/software/S0292) is an open-source remote access tool for Android devices. [AndroRAT](https://attack.mitre.org/software/S0292) is capable of collecting data, such as device location, call logs, etc., and is capable of executing actions, such as sending SMS messages and taking pictures.(Citation: Lookout-EnterpriseApps)(Citation: github_androrat)(Citation: Forcepoint BITTER Pakistan Oct 2016) It is originally available through the `The404Hacking` Github repository.(Citation: github_androrat)" ; dcterms:title "AndroRAT" . attack-res:malware--a5528622-3a8a-4633-86ce-8cdaf8423858 a attack:Malware, attack:Software ; dcterms:description "[FinFisher](https://attack.mitre.org/software/S0182) is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including [Wingbird](https://attack.mitre.org/software/S0176). (Citation: FinFisher Citation) (Citation: Microsoft SIR Vol 21) (Citation: FireEye FinSpy Sept 2017) (Citation: Securelist BlackOasis Oct 2017) (Citation: Microsoft FinFisher March 2018)" ; dcterms:title "FinFisher" . attack-res:malware--a6228601-03f6-4949-ae22-c1087627a637 a attack:Malware, attack:Software ; dcterms:description "[Agent Smith](https://attack.mitre.org/software/S0440) is mobile malware that generates financial gain by replacing legitimate applications on devices with malicious versions that include fraudulent ads. As of July 2019 [Agent Smith](https://attack.mitre.org/software/S0440) had infected around 25 million devices, primarily targeting India though effects had been observed in other Asian countries as well as Saudi Arabia, the United Kingdom, and the United States.(Citation: CheckPoint Agent Smith)" ; dcterms:title "Agent Smith" . attack-res:malware--a76b837b-93cc-417d-bf28-c47a6a284fa4 a attack:Malware, attack:Software ; dcterms:description "[Asacub](https://attack.mitre.org/software/S0540) is a banking trojan that attempts to steal money from victims’ bank accounts. It attempts to do this by initiating a wire transfer via SMS message from compromised devices.(Citation: Securelist Asacub)" ; dcterms:title "Asacub" . attack-res:malware--a993495c-9813-4372-b9ec-d168c7f7ec0a a attack:Malware, attack:Software ; dcterms:description "[GPlayed](https://attack.mitre.org/software/S0536) is an Android trojan with a broad range of capabilities.(Citation: Talos GPlayed) " ; dcterms:title "GPlayed" . attack-res:malware--aecc0097-c9f8-4786-9b39-e891ff173f54 a attack:Malware, attack:Software ; dcterms:description "[EventBot](https://attack.mitre.org/software/S0478) is an Android banking trojan and information stealer that abuses Android’s accessibility service to steal data from various applications.(Citation: Cybereason EventBot) [EventBot](https://attack.mitre.org/software/S0478) was designed to target over 200 different banking and financial applications, the majority of which are European bank and cryptocurrency exchange applications.(Citation: Cybereason EventBot)" ; dcterms:title "EventBot" . attack-res:malware--aef537ba-10c2-40ed-a57a-80b8508aada4 a attack:Malware, attack:Software ; dcterms:description "[HenBox](https://attack.mitre.org/software/S0544) is Android malware that attempts to only execute on Xiaomi devices running the MIUI operating system. [HenBox](https://attack.mitre.org/software/S0544) has primarily been used to target Uyghurs, a minority Turkic ethnic group.(Citation: Palo Alto HenBox)" ; dcterms:title "HenBox" . attack-res:malware--b0a243dd-8075-42f9-86f6-64989600ed20 a attack:Malware, attack:Software ; dcterms:description "[Binary Validator](https://attack.mitre.org/software/S1215) is a Mach-O binary file used during [Operation Triangulation](https://attack.mitre.org/campaigns/C0054).(Citation: SecureList OpTriangulation 23Oct2023) [Binary Validator](https://attack.mitre.org/software/S1215) first collects information about the device, such as the device's phone number and a list of installed applications, before the deployment of the [TriangleDB](https://attack.mitre.org/software/S1216) implant. After the actions are completed and the data is collected, [Binary Validator](https://attack.mitre.org/software/S1215) encrypts and sends the data to the C2 server, and in turn, the C2 server sends the [TriangleDB](https://attack.mitre.org/software/S1216) implant." ; dcterms:title "Binary Validator" . attack-res:malware--bf064476-25b8-493c-a1e7-dd707b3f7f52 a attack:Malware, attack:Software ; dcterms:description "[GodFather](https://attack.mitre.org/software/S1231) is an Android banking malware that uses virtualization to mimic legitimate applications and abuses accessibility services and other permissions to evade detection and exfiltrate sensitive data. First identified in 2020, [GodFather](https://attack.mitre.org/software/S1231) targets nearly 500 banking applications, cryptocurrency wallets, and exchanges worldwide; however, its virtualization-based attacks have primarily focused on several Turkish financial institutions. This capability enables threat actors to steal banking credentials and other sensitive account information. (Citation: ZimperiumOrtegaPratapagiri_GodFather_Jun2025)(Citation: MerkleScience_Godfather_April2023)" ; dcterms:title "GodFather" . attack-res:malware--c0efbaae-9e7d-4716-a92d-68373aac7424 a attack:Malware, attack:Software ; dcterms:description "[Riltok](https://attack.mitre.org/software/S0403) is banking malware that uses phishing popups to collect user credentials.(Citation: Kaspersky Riltok June 2019)" ; dcterms:title "Riltok" . attack-res:malware--c19cfc89-5ac6-4d2d-a236-70d2b32e007c a attack:Malware, attack:Software ; dcterms:description "[GolfSpy](https://attack.mitre.org/software/S0421) is Android spyware deployed by the group [Bouncing Golf](https://attack.mitre.org/groups/G0097).(Citation: Trend Micro Bouncing Golf 2019)" ; dcterms:title "GolfSpy" . attack-res:malware--c41a8b7c-3e42-4eee-b87d-ad8a100ee878 a attack:Malware, attack:Software ; dcterms:description "[Pallas](https://attack.mitre.org/software/S0399) is mobile surveillanceware that was custom-developed by [Dark Caracal](https://attack.mitre.org/groups/G0070).(Citation: Lookout Dark Caracal Jan 2018)" ; dcterms:title "Pallas" . attack-res:malware--c6a07c89-a24c-4c7e-9e3e-6153cc595e24 a attack:Malware, attack:Software ; dcterms:description "[Circles](https://attack.mitre.org/software/S0602) reportedly takes advantage of Signaling System 7 (SS7) weaknesses, the protocol suite used to route phone calls, to both track the location of mobile devices and intercept voice calls and SMS messages. It can be connected to a telecommunications company’s infrastructure or purchased as a cloud service. Circles has reportedly been linked to the NSO Group.(Citation: CitizenLab Circles)" ; dcterms:title "Circles" . attack-res:malware--c6abcaf8-1765-41f8-9fe5-03d42fd0f6c0 a attack:Malware, attack:Software ; dcterms:description "[Tiktok Pro](https://attack.mitre.org/software/S0558) is spyware that has been masquerading as the TikTok application.(Citation: Zscaler TikTok Spyware)" ; dcterms:title "Tiktok Pro" . attack-res:malware--c709da93-20c3-4d17-ab68-48cba76b2137 a attack:Malware, attack:Software ; dcterms:description "[PJApps](https://attack.mitre.org/software/S0291) is an Android malware family. (Citation: Lookout-EnterpriseApps)" ; dcterms:title "PJApps" . attack-res:malware--c80a6bef-b3ce-44d0-b113-946e93124898 a attack:Malware, attack:Software ; dcterms:description "[ShiftyBug](https://attack.mitre.org/software/S0294) is an auto-rooting adware family of malware for Android. The family is very similar to the other Android families known as Shedun, Shuanet, Kemoge, though it is not believed all the families were created by the same group. (Citation: Lookout-Adware)" ; dcterms:title "ShiftyBug" . attack-res:malware--c8770c81-c29f-40d2-a140-38544206b2b4 a attack:Malware, attack:Software ; dcterms:description "[HummingBad](https://attack.mitre.org/software/S0322) is a family of Android malware that generates fraudulent advertising revenue and has the ability to obtain root access on older, vulnerable versions of Android. (Citation: ArsTechnica-HummingBad)" ; dcterms:title "HummingBad" . attack-res:malware--c91cec55-634c-4670-ba10-2dc7ceb28e98 a attack:Malware, attack:Software ; dcterms:description "[Exobot](https://attack.mitre.org/software/S0522) is Android banking malware, primarily targeting financial institutions in Germany, Austria, and France.(Citation: Threat Fabric Exobot)" ; dcterms:title "Exobot" . attack-res:malware--ca4f63b9-a358-4214-bb26-8c912318cfde a attack:Malware, attack:Software ; dcterms:description "OBAD is an Android malware family. (Citation: TrendMicro-Obad)" ; dcterms:title "OBAD" . attack-res:malware--cfe91950-c01f-4e1f-ada1-7ac9b4f79fd4 a attack:Malware, attack:Software ; dcterms:description "[FjordPhantom](https://attack.mitre.org/software/S1208) is a malicious Android application first discovered in September 2024 with targets in Southeast Asia, specifically Indonesia, Thailand, and Vietnam. [FjordPhantom](https://attack.mitre.org/software/S1208) was distributed through email and messaging applications. Once installed, the application launches a virtualization solution to steal important information, such as bank accounts, and to manipulate the user interface. The malicious activity from the virtualization solution runs alongside legitimate banking applications.(Citation: Promon FjordPhantom Oct2024) " ; dcterms:title "FjordPhantom" . attack-res:malware--d05f7357-4cbe-47ea-bf83-b8604226d533 a attack:Malware, attack:Software ; dcterms:description "[Android/Chuli.A](https://attack.mitre.org/software/S0304) is Android malware that was delivered to activist groups via a spearphishing email with an attachment. (Citation: Kaspersky-WUC)" ; dcterms:title "Android/Chuli.A" . attack-res:malware--d1c600f8-0fb6-4367-921b-85b71947d950 a attack:Malware, attack:Software ; dcterms:description "[Charger](https://attack.mitre.org/software/S0323) is Android malware that steals steals contacts and SMS messages from the user's device. It can also lock the device and demand ransom payment if it receives admin permissions. (Citation: CheckPoint-Charger)" ; dcterms:title "Charger" . attack-res:malware--d6e009b7-df5e-447a-bfd2-d5b77374edfe a attack:Malware, attack:Software ; dcterms:description "[Drinik](https://attack.mitre.org/software/S1054) is an evolving Android banking trojan that was observed targeting customers of around 27 banks in India in August 2021. Initially seen as an SMS stealer in 2016, [Drinik](https://attack.mitre.org/software/S1054) resurfaced as a banking trojan with more advanced capabilities included in subsequent versions between September 2021 and August 2022.(Citation: cyble_drinik_1022)" ; dcterms:title "Drinik" . attack-res:malware--d89c132d-7752-4c7f-9372-954a71522985 a attack:Malware, attack:Software ; dcterms:description "[Trojan-SMS.AndroidOS.OpFake.a](https://attack.mitre.org/software/S0308) is Android malware. (Citation: Kaspersky-MobileMalware)" ; dcterms:title "Trojan-SMS.AndroidOS.OpFake.a" . attack-res:malware--d9e07aea-baad-4b68-bdca-90c77647d7f9 a attack:Malware, attack:Software ; dcterms:description "[XcodeGhost](https://attack.mitre.org/software/S0297) is iOS malware that infected at least 39 iOS apps in 2015 and potentially affected millions of users. (Citation: PaloAlto-XcodeGhost1) (Citation: PaloAlto-XcodeGhost)" ; dcterms:title "XcodeGhost" . attack-res:malware--ddbe5657-e21e-4a89-8221-2f1362d397ec a attack:Malware, attack:Software ; dcterms:description "[SilkBean](https://attack.mitre.org/software/S0549) is a piece of Android surveillanceware containing comprehensive remote access tool (RAT) functionality that has been used in targeting of the Uyghur ethnic group.(Citation: Lookout Uyghur Campaign)" ; dcterms:title "SilkBean" . attack-res:malware--dfdac962-9461-47f0-a212-36dfce2a97e6 a attack:Malware, attack:Software ; dcterms:description "[WolfRAT](https://attack.mitre.org/software/S0489) is malware based on a leaked version of [Dendroid](https://attack.mitre.org/software/S0301) that has primarily targeted Thai users. [WolfRAT](https://attack.mitre.org/software/S0489) has most likely been operated by the now defunct organization Wolf Research.(Citation: Talos-WolfRAT) " ; dcterms:title "WolfRAT" . attack-res:malware--e110f94a-e2c5-4f5f-ba78-9c2ab6d2d9e4 a attack:Malware, attack:Software ; dcterms:description "[BusyGasper](https://attack.mitre.org/software/S0655) is Android spyware that has been in use since May 2016. There have been less than 10 victims, all who appear to be located in Russia, that were all infected via physical access to the device.(Citation: SecureList BusyGasper)" ; dcterms:title "BusyGasper" . attack-res:malware--e13d084c-382f-40fd-aa9a-98d69e20301e a attack:Malware, attack:Software ; dcterms:description "[BrainTest](https://attack.mitre.org/software/S0293) is a family of Android malware. (Citation: CheckPoint-BrainTest) (Citation: Lookout-BrainTest)" ; dcterms:title "BrainTest" . attack-res:malware--e296b110-46d3-4f7a-894c-cc71ea50168c a attack:Malware, attack:Software ; dcterms:description "[TERRACOTTA](https://attack.mitre.org/software/S0545) is an ad fraud botnet that has been capable of generating over 2 billion fraudulent requests per week.(Citation: WhiteOps TERRACOTTA)" ; dcterms:title "TERRACOTTA" . attack-res:malware--ec13d292-6d8d-4c7a-b07c-a2bd2402569a a attack:Malware, attack:Software ; dcterms:description "[Escobar](https://attack.mitre.org/software/S1092) is an Android banking trojan, first detected in March 2021, believed to be a new variant of AbereBot.(Citation: Bleeipng Computer Escobar)" ; dcterms:title "Escobar" . attack-res:malware--eed7b988-0279-4c4f-bfa9-d81f5444a04b a attack:Malware, attack:Software ; dcterms:description "[Crocodilus](https://attack.mitre.org/software/S9004) is an Android banking Trojan that was discovered in March 2025. [Crocodilus](https://attack.mitre.org/software/S9004) targeted users worldwide, including Turkey, Poland, Argentina, Brazil, Spain, the United States, Indonesia and India. [Crocodilus](https://attack.mitre.org/software/S9004) has been customized based on the target location. For example, [Crocodilus](https://attack.mitre.org/software/S9004) mimicked major Turkish and Spanish banks for users in Turkey and Spain, while users in Poland saw Facebook advertisements that promoted [Crocodilus](https://attack.mitre.org/software/S9004) to claim bonus points.(Citation: ThreatFabric_Crocodilus_March2025)(Citation: ThreatFabric_Crocodilus_June2025) " ; dcterms:title "Crocodilus" . attack-res:malware--f082d7dd-20a9-4157-93c0-75e7aea09e42 a attack:Malware, attack:Software ; dcterms:description "[Android/SpyAgent](https://attack.mitre.org/software/S1214) is a variant of spyware in the MoqHao phishing campaign primarily targeting Korean and Japanese users.(Citation: McAfee MoqHao 2019) Fake security applications were used to target Japanese users, while fake police applications were used to target Korean users. Both fake applications have common C2 commands and share the same crash report key on a cloud service.(Citation: McAfee MoqHao 2019)" ; dcterms:title "Android/SpyAgent" . attack-res:malware--f082fc59-0317-49cf-971f-a1b6296ebb52 a attack:Malware, attack:Software ; dcterms:description "[Triada](https://attack.mitre.org/software/S0424) was first reported in 2016 as a second stage malware. Later versions in 2019 appeared with new techniques and as an initial downloader of other Trojan apps.(Citation: Kaspersky Triada March 2016)" ; dcterms:title "Triada" . attack-res:malware--f3975cc0-72bc-4308-836e-ac701b83860e a attack:Malware, attack:Software ; dcterms:description "[Golden Cup](https://attack.mitre.org/software/S0535) is Android spyware that has been used to target World Cup fans.(Citation: Symantec GoldenCup) " ; dcterms:title "Golden Cup" . attack-res:malware--f5ff006c-702f-4ded-8e60-ca6c540d91bc a attack:Malware, attack:Software ; dcterms:description "[FluBot](https://attack.mitre.org/software/S1067) is a multi-purpose mobile banking malware that was first observed in Spain in late 2020. It primarily spread through European countries using a variety of SMS phishing messages in multiple languages.(Citation: proofpoint_flubot_0421)(Citation: bitdefender_flubot_0524) An international law enforcement operation of 11 countries eventually disrupted the spread of [FluBot](https://attack.mitre.org/software/S1067).(Citation: Europol FluBot Jun2022)" ; dcterms:title "FluBot" . attack-res:malware--f666e17c-b290-43b3-8947-b96bd5148fbb a attack:Malware, attack:Software ; dcterms:description "[ViperRAT](https://attack.mitre.org/software/S0506) is sophisticated surveillanceware that has been in operation since at least 2015 and was used to target the Israeli Defense Force.(Citation: Lookout ViperRAT) " ; dcterms:title "ViperRAT" . attack-res:malware--f6ac21b6-2592-400c-8472-10d0e2f1bfaf a attack:Malware, attack:Software ; dcterms:description "[Adups](https://attack.mitre.org/software/S0309) is software that was pre-installed onto Android devices, including those made by BLU Products. The software was reportedly designed to help a Chinese phone manufacturer monitor user behavior, transferring sensitive data to a Chinese server. (Citation: NYTimes-BackDoor) (Citation: BankInfoSecurity-BackDoor)" ; dcterms:title "Adups" . attack-res:malware--f79c01eb-2954-40d8-a819-00b342f47ce7 a attack:Malware, attack:Software ; dcterms:description "[SimBad](https://attack.mitre.org/software/S0419) was a strain of adware on the Google Play Store, distributed through the RXDroider Software Development Kit. The name \"SimBad\" was derived from the fact that most of the infected applications were simulator games. The adware was controlled using an instance of the open source framework Parse Server.(Citation: CheckPoint SimBad 2019)" ; dcterms:title "SimBad" . attack-res:malware--f7e7b736-2cff-4c2a-9232-352cd383463a a attack:Malware, attack:Software ; dcterms:description "[Android/AdDisplay.Ashas](https://attack.mitre.org/software/S0525) is a variant of adware that has been distributed through multiple apps in the Google Play Store. (Citation: WeLiveSecurity AdDisplayAshas)" ; dcterms:title "Android/AdDisplay.Ashas" . attack-res:malware--f97e2718-af50-41df-811f-215ebab45691 a attack:Malware, attack:Software ; dcterms:description "[Phenakite](https://attack.mitre.org/software/S1126) is a mobile malware that is used by [APT-C-23](https://attack.mitre.org/groups/G1028) to target iOS devices. According to several reports, [Phenakite](https://attack.mitre.org/software/S1126) was developed to fill a tooling gap and to target those who owned iPhones instead of Windows desktops or Android phones.(Citation: sentinelone_israel_hamas_war)(Citation: fb_arid_viper)" ; dcterms:title "Phenakite" . attack-res:malware--fd6d56b2-d84e-4d2a-b37d-d4678d3e08a6 a attack:Malware, attack:Software ; dcterms:description "[TianySpy](https://attack.mitre.org/software/S1056) is a mobile malware primarily spread by SMS phishing between September 30 and October 12, 2021. [TianySpy](https://attack.mitre.org/software/S1056) is believed to have targeted credentials associated with membership websites of major Japanese telecommunication services.(Citation: trendmicro_tianyspy_0122) " ; dcterms:title "TianySpy" . attack-res:malware--feae299d-e34f-4fc9-8545-486d0905bd41 a attack:Malware, attack:Software ; dcterms:description "[Sunbird](https://attack.mitre.org/software/S1082) is one of two mobile malware families known to be used by the APT [Confucius](https://attack.mitre.org/groups/G0142). Analysis suggests that [Sunbird](https://attack.mitre.org/software/S1082) was first active in early 2017. While [Sunbird](https://attack.mitre.org/software/S1082) and [Hornbill](https://attack.mitre.org/software/S1077) overlap in core capabilities, [Sunbird](https://attack.mitre.org/software/S1082) has a more extensive set of malicious features.(Citation: lookout_hornbill_sunbird_0221)" ; dcterms:title "Sunbird" . attack-res:malware--ff742eeb-1f90-4f5a-8b92-9d40fffd99ca a attack:Malware, attack:Software ; dcterms:description "[DressCode](https://attack.mitre.org/software/S0300) is an Android malware family. (Citation: TrendMicro-DressCode)" ; dcterms:title "DressCode" . attack-res:malware--ff8e0c38-be47-410f-a2d3-a3d24a87c617 a attack:Malware, attack:Software ; dcterms:description "[Gustuff](https://attack.mitre.org/software/S0406) is mobile malware designed to steal users' banking and virtual currency credentials.(Citation: Talos Gustuff Apr 2019)" ; dcterms:title "Gustuff" . a attack:Tactic ; dcterms:description """The adversary is trying to gather data of interest to their goal. Collection consists of techniques used to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This category also covers locations on a system or network where the adversary may look for information to exfiltrate.""" ; dcterms:title "Collection" ; attack:shortname "collection" . a attack:Tactic ; dcterms:description """The adversary is trying to communicate with compromised devices to control them. The command and control tactic represents how adversaries communicate with systems under their control within a target network. There are many ways an adversary can establish command and control with various levels of covertness, depending on system configuration and network topology. Due to the wide degree of variation available to the adversary at the network level, only the most common factors were used to describe the differences in command and control. There are still a great many specific techniques within the documented methods, largely due to how easy it is to define new protocols and use existing, legitimate protocols and network services for communication. The resulting breakdown should help convey the concept that detecting intrusion through command and control protocols without prior knowledge is a difficult proposition over the long term. Adversaries' main constraints in network-level defense avoidance are testing and deployment of tools to rapidly change their protocols, awareness of existing defensive technologies, and access to legitimate Web services that, when used appropriately, make their tools difficult to distinguish from benign traffic. Additionally, in the mobile environment, mobile devices are frequently connected to networks outside enterprise control such as cellular networks or public Wi-Fi networks. Adversaries could attempt to evade detection by communicating on these networks, and potentially even by using non-Internet Protocol mechanisms such as Short Message Service (SMS). However, cellular networks often have data caps and/or extra data charges that could increase the potential for adversarial communication to be detected.""" ; dcterms:title "Command and Control" ; attack:shortname "command-and-control" . a attack:Tactic ; dcterms:description """The adversary is trying to steal account names, passwords, or other secrets that enable access to resources. Credential access represents techniques that can be used by adversaries to obtain access to or control over passwords, tokens, cryptographic keys, or other values that could be used by an adversary to gain unauthorized access to resources. Credential access allows the adversary to assume the identity of an account, with all of that account's permissions on the system and network, and makes it harder for defenders to detect the adversary. With sufficient access within a network, an adversary can create accounts for later use within the environment.""" ; dcterms:title "Credential Access" ; attack:shortname "credential-access" . a attack:Tactic ; dcterms:description """ The adversary is trying to avoid being detected. Defense evasion consists of techniques an adversary may use to evade detection or avoid other defenses. Sometimes these actions are the same as or variations of techniques in other categories that have the added benefit of subverting a particular defense or mitigation. Defense evasion may be considered a set of attributes the adversary applies to all other phases of the operation.""" ; dcterms:title "Defense Evasion" ; attack:shortname "defense-evasion" . a attack:Tactic ; dcterms:description """The adversary is trying to figure out your environment. Discovery consists of techniques that allow the adversary to gain knowledge about the characteristics of the mobile device and potentially other networked systems. When adversaries gain access to a new system, they must orient themselves to what they now have control of and what benefits operating from that system give to their current objective or overall goals during the intrusion. The operating system may provide capabilities that aid in this post-compromise information-gathering phase.""" ; dcterms:title "Discovery" ; attack:shortname "discovery" . a attack:Tactic ; dcterms:description """The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a mobile device. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data.""" ; dcterms:title "Execution" ; attack:shortname "execution" . a attack:Tactic ; dcterms:description """The adversary is trying to steal data. Exfiltration refers to techniques and attributes that result or aid in the adversary removing files and information from the targeted mobile device. In the mobile environment, mobile devices are frequently connected to networks outside enterprise control such as cellular networks or public Wi-Fi networks. Adversaries could attempt to evade detection by communicating on these networks, and potentially even by using non-Internet Protocol mechanisms such as Short Message Service (SMS). However, cellular networks often have data caps and/or extra data charges that could increase the potential for adversarial communication to be detected.""" ; dcterms:title "Exfiltration" ; attack:shortname "exfiltration" . a attack:Tactic ; dcterms:description """The adversary is trying to manipulate, interrupt, or destroy your devices and data. The impact tactic consists of techniques used by the adversary to execute his or her mission objectives but that do not cleanly fit into another category such as Collection. Mission objectives vary based on each adversary's goals, but examples include toll fraud, destruction of device data, or locking the user out of his or her device until a ransom is paid.""" ; dcterms:title "Impact" ; attack:shortname "impact" . a attack:Tactic ; dcterms:description """The adversary is trying to get into your device. The initial access tactic represents the vectors adversaries use to gain an initial foothold onto a mobile device.""" ; dcterms:title "Initial Access" ; attack:shortname "initial-access" . a attack:Tactic ; dcterms:description """The adversary is trying to move through your environment. Lateral movement consists of techniques that enable an adversary to access and control remote systems on a network and could, but does not necessarily, include execution of tools on remote systems. The lateral movement techniques could allow an adversary to gather information from a system without needing additional tools, such as a remote access tool.""" ; dcterms:title "Lateral Movement" ; attack:shortname "lateral-movement" . a attack:Tactic ; dcterms:description """ The adversary is trying to maintain their foothold. Persistence is any access, action, or configuration change to a mobile device that gives an attacker a persistent presence on the device. Attackers often will need to maintain access to mobile devices through interruptions such as device reboots and potentially even factory data resets.""" ; dcterms:title "Persistence" ; attack:shortname "persistence" . a attack:Tactic ; dcterms:description """ The adversary is trying to gain higher-level permissions. Privilege escalation includes techniques that allow an attacker to obtain a higher level of permissions on the mobile device. Attackers may enter the mobile device with very limited privileges and may be required to take advantage of a device weakness to obtain higher privileges necessary to successfully carry out their mission objectives.""" ; dcterms:title "Privilege Escalation" ; attack:shortname "privilege-escalation" . attack-res:tool--1622fd3d-fcfc-4d02-ac49-f2d786f79b81 a attack:Software, attack:Tool ; dcterms:description """[FlexiSpy](https://attack.mitre.org/software/S0408) is sophisticated surveillanceware for iOS and Android. Publicly-available, comprehensive analysis has only been found for the Android version.(Citation: FortiGuard-FlexiSpy)(Citation: CyberMerchants-FlexiSpy) [FlexiSpy](https://attack.mitre.org/software/S0408) markets itself as a parental control and employee monitoring application.(Citation: FlexiSpy-Website)""" ; dcterms:title "FlexiSpy" . attack-res:tool--da21929e-40c0-443d-bdf4-6b60d15448b4 a attack:Software, attack:Tool ; dcterms:description "[Xbot](https://attack.mitre.org/software/S0298) is an Android malware family that was observed in 2016 primarily targeting Android users in Russia and Australia. (Citation: PaloAlto-Xbot)" ; dcterms:title "Xbot" . attack-res:x-mitre-data-component--181a9f8c-c780-4f1f-91a8-edb770e904ba a attack:DataComponent ; dcterms:title "Network Connection Creation" . attack-res:x-mitre-data-component--1887a270-576a-4049-84de-ef746b2572d6 a attack:DataComponent ; dcterms:title "Process Access" . attack-res:x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71 a attack:DataComponent ; dcterms:title "File Access" . attack-res:x-mitre-data-component--2b3bfe19-d59a-460d-93bb-2f546adc2d2c a attack:DataComponent ; dcterms:title "File Creation" . attack-res:x-mitre-data-component--3772e279-27d6-477a-9fe3-c6beb363594c a attack:DataComponent ; dcterms:title "Network Traffic Content" . attack-res:x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077 a attack:DataComponent ; dcterms:title "Process Creation" . attack-res:x-mitre-data-component--55c669d9-b42a-4cf6-a38a-07161b228ce9 a attack:DataComponent ; dcterms:title "Application State" . attack-res:x-mitre-data-component--56c2b384-77f8-461f-a71a-76f7888ebfb6 a attack:DataComponent ; dcterms:title "System Settings" . attack-res:x-mitre-data-component--5ae32c6a-2d12-4b8f-81ca-f862f2be0962 a attack:DataComponent ; dcterms:title "API Calls" . attack-res:x-mitre-data-component--613788f2-ad72-43f5-b5f7-a93e2adc70fa a attack:DataComponent ; dcterms:title "Application Assets" . attack-res:x-mitre-data-component--61f1d40e-f3d0-4cc6-aa2d-937b6204194f a attack:DataComponent ; dcterms:title "Process Termination" . attack-res:x-mitre-data-component--639e87f3-acb6-448a-9645-258f20da4bc5 a attack:DataComponent ; dcterms:title "File Metadata" . attack-res:x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0 a attack:DataComponent ; dcterms:title "Command Execution" . attack-res:x-mitre-data-component--6c62144a-cd5c-401c-ada9-58c4c74cd9d2 a attack:DataComponent ; dcterms:title "Protected Configuration" . attack-res:x-mitre-data-component--764ee29e-48d6-4934-8e6b-7a606aaaafc0 a attack:DataComponent ; dcterms:title "Network Communication" . attack-res:x-mitre-data-component--84572de3-9583-4c73-aabd-06ea88123dd8 a attack:DataComponent ; dcterms:title "File Modification" . attack-res:x-mitre-data-component--85a533a4-5fa4-4dba-b45d-f0717bedd6e6 a attack:DataComponent ; dcterms:title "Host Status" . attack-res:x-mitre-data-component--8c826308-2760-492f-9e36-4f0f7e23bcac a attack:DataComponent ; dcterms:title "Cloud Service Enumeration" . attack-res:x-mitre-data-component--9bde2f9d-a695-4344-bfac-f2dce13d121e a attack:DataComponent ; dcterms:title "OS API Execution" . attack-res:x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa a attack:DataComponent ; dcterms:title "Application Log Content" . attack-res:x-mitre-data-component--a7f22107-02e5-4982-9067-6625d4a1765a a attack:DataComponent ; dcterms:title "Network Traffic Flow" . attack-res:x-mitre-data-component--a953ca55-921a-44f7-9b8d-3d40141aa17e a attack:DataComponent ; dcterms:title "User Account Authentication" . attack-res:x-mitre-data-component--b1e0bb80-23d4-44f2-b919-7e9c54898f43 a attack:DataComponent ; dcterms:title "Application Permission" . attack-res:x-mitre-data-component--bf0ff551-a5a7-40e5-bff9-f9405011b1f4 a attack:DataComponent ; dcterms:title "System Notifications" . attack-res:x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1 a attack:DataComponent ; dcterms:title "Module Load" . attack-res:x-mitre-data-component--e2f72131-14d1-411f-8e8c-aa3453dd5456 a attack:DataComponent ; dcterms:title "Permissions Request" . attack-res:x-mitre-data-component--e905dad2-00d6-477c-97e8-800427abd0e8 a attack:DataComponent ; dcterms:title "File Deletion" . attack-res:x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1 a attack:DataComponent ; dcterms:title "Process Metadata" . attack-res:x-mitre-data-component--f42df6f0-6395-4f0c-9376-525a031f00c3 a attack:DataComponent ; dcterms:title "Scheduled Job Creation" .