aol.pm

Desert Scorpion

Software · ATTACK:mobile:S0505

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:S0505",
  "title": "Desert Scorpion",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0505",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--3271c107-92c4-442e-9506-e76d62230ee8",
  "external_id": "S0505",
  "domain": "mobile",
  "created": "2020-09-11T14:54:16.188Z",
  "modified": "2025-01-13T17:52:20.612Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Lookout Desert Scorpion",
      "url": "https://blog.lookout.com/desert-scorpion-google-play"
    },
    {
      "source_name": "Unit42 VAMP 2017",
      "url": "https://unit42.paloaltonetworks.com/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/"
    },
    {
      "source_name": "Trendmicro GnatSpy 2017",
      "url": "https://www.trendmicro.com/en_us/research/17/l/new-gnatspy-mobile-malware-family-discovered.html"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--027a36dc-cd9e-4282-b101-b9a0abbb312f

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05243ccb-0aeb-4db4-bb03-51a65fb715ab

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b5bfa77-51b4-41b4-ae03-88b585d143c1

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b7be26d-cb1d-497b-94bf-a34f11ed66c9

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c9ad579-0c29-4f2a-80f3-242dc6b0bafd

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38f96449-dfb1-49db-b0d0-f257c3ee2c5d

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--670a0995-a789-4674-9e91-c74316cdef90

Lookout Desert Scorpion

ATTACK:mobile:G1028 → uses → ATTACK:mobile:S0505

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b623a18-a3cf-4f94-b3a8-19f7369a2b61

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6de29595-e63e-4d7e-992f-b4622b7b8e23

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f27a13d-b353-47f3-8a71-a13e8c4c3d60

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a961514-3372-4c3e-b7ee-e3d053c3d5f3

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b2c2716-a62b-4c3a-a211-d72bb5ed29b9

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c9dbc53-27d2-420c-b698-98c23a7ead2b

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--972f0703-f4d7-42d2-8ca2-bec175dac0bf

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98b14660-79e1-4244-99c2-3dedd84eb68d

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99b4be95-74f2-48f7-b4e9-8b4d88ecd31f

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd6829ee-dc51-477b-9739-1cd1cd304b6c

Lookout Desert Scorpion

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c659256c-82e3-4f4c-ac70-3d2400cf6695

Lookout Desert Scorpion

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.