Skip to content

Archive Collected Data

Technique · ATTACK:mobile:T1532

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1532",
  "title": "Archive Collected Data",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1532",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e3b936a4-6321-4172-9114-038a866362ec",
  "external_id": "T1532",
  "domain": "mobile",
  "created": "2019-10-10T15:00:44.181Z",
  "modified": "2025-10-24T17:49:31.761Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [

  ]
}

Explicit source assertions (14)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--027a36dc-cd9e-4282-b101-b9a0abbb312f

Lookout Desert Scorpion

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10e02179-0434-4d4b-86b4-5d9fbc5d5451

SWB Exodus March 2019

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11a992e7-83a3-4dc3-b391-fbd79e518943

lookout_bouldspy_0423

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2621a020-8d4f-4ca4-b874-0be336a8cafd

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--494ece43-ebba-4519-86be-cd5c4d4dd337

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2024

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a609b20b-6955-4c59-84d4-a3496d95fba1

cleafy_brata_0122

ATTACK:mobile:S0424 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5f3b110-fc66-4369-89f3-621c945d655f

Google Triada June 2019

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be526f3a-480f-4ede-b772-2b29b8a3ca2b

welivesec_strongpity

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca9e5e50-49e9-44cc-a0a4-4ec8633a9506

Symantec GoldenCup

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ccb6f906-a785-4695-91a5-f1bc210892dc

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1243 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cea64a5c-1a69-4714-a6b9-2c6764f1fcab

Lookout_DCHSpy_July2025

ATTACK:mobile:S0577 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6e4fdc6-c936-4bb9-861f-fafd3b72fcb4

Lookout FrozenCell

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d933bba1-61ab-4fea-b7db-7e2a4f4146e7

Securelist Asacub

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5e4567e-05a3-4d79-beab-191efc336473

Trend Micro Bouncing Golf 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.