Crocodilus
Software · ATTACK:mobile:S9004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:S9004",
"title": "Crocodilus",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9004",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--eed7b988-0279-4c4f-bfa9-d81f5444a04b",
"external_id": "S9004",
"domain": "mobile",
"created": "2026-02-06T21:22:59.796Z",
"modified": "2026-04-23T03:24:47.669Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ThreatFabric_Crocodilus_June2025",
"url": "https://www.threatfabric.com/blogs/crocodilus-mobile-malware-evolving-fast-going-global"
},
{
"source_name": "ThreatFabric_Crocodilus_March2025",
"url": "https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1407
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--006e9850-9213-40c8-bfe0-5dac4383c9c2
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1406
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04d9e597-f25b-40cf-bdb6-d552255acc78
ThreatFabric_Crocodilus_June2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1655
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f265012-567d-45e9-9dc2-e1fd1be5bb93
ThreatFabric_Crocodilus_June2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1616
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10c912f6-6e0c-41a7-9911-f7fa5c9ba6f8
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1646
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1151b8cc-035b-46e2-ab5a-46e719ef97f8
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1512
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1208139a-5df5-40e9-ab7b-390f38530757
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1582
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--174b139b-83ff-4cdc-889f-6e5936731741
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1628.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--711d0a57-1e3f-4598-80a4-952b6ad9ada4
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1630.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--967e0bbc-879c-49b9-809b-cd55861709bd
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1437.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98420345-5cf0-4145-b41b-54001847edb0
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a67a9c6f-318a-4ca5-aa6a-1d6d88b5d523
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1636.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--adfc0dc7-cdb4-44be-b8d5-2292a95ad654
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1513
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7df5791-eff5-48f2-8111-1460d6066f53
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1636.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0d66439-0ae4-4565-8b3a-e92e48e8d3c1
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ceea7970-a921-4c59-9e28-de76af1d92fb
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1626.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1a78380-2464-4906-8709-237ff3306225
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1406.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc2c709d-89cf-46b9-98d3-385e33c23e34
ThreatFabric_Crocodilus_June2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1418
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e43098c9-bbdf-4330-baf2-1d04f93255ba
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1629.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebebb43d-aeec-4436-9d6f-c11fc8de82f3
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1417.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2661ec3-9c63-4ad8-91a9-8bd0e50a0cc3
ThreatFabric_Crocodilus_March2025ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc8d747d-d6d0-4599-955b-325d8489e84c
ThreatFabric_Crocodilus_June2025