Skip to content

ViperRAT

Software · ATTACK:mobile:S0506

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:S0506",
  "title": "ViperRAT",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0506",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--f666e17c-b290-43b3-8947-b96bd5148fbb",
  "external_id": "S0506",
  "domain": "mobile",
  "created": "2020-09-11T16:22:02.954Z",
  "modified": "2026-09-02T18:46:02.947Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Lookout ViperRAT",
      "url": "https://blog.lookout.com/viperrat-mobile-apt"
    }
  ]
}

Explicit source assertions (14)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--078653a6-3613-4923-ae5a-1bccb8552e67

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11a1da8f-f0db-4abe-88bb-1ab06f271f3f

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--173c0c41-c7e3-48e9-b785-d9e0232d85ca

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1476

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--336f139f-b771-48d4-a3d6-7ef94289d56e

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51b0a4fb-a308-4694-9437-95702a50ebd5

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c859d6b-28b1-409d-90ea-d4eba64edf82

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c6207c7-d738-4a17-8380-595c86574b64

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6726136-3c20-4921-a0cb-75a66f59107c

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c86918a3-6e41-4dfb-8b18-650fff596801

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce645a25-160f-443d-b288-fdd108b78a06

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d358ac0b-4c67-44e3-939b-24cd36d3c3fb

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1422.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d447a927-c8a1-4123-bdac-ff9ab36f49be

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8ca4ea5-5242-4f0f-b3b7-008673f561ab

Lookout ViperRAT

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--faff9f9c-9064-4b3a-bdf9-bbeced2447a6

Lookout ViperRAT

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.