aol.pm

Ingress Tool Transfer

Technique · ATTACK:mobile:T1544

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1544",
  "title": "Ingress Tool Transfer",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1544",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--2bb20118-e6c0-41dc-a07c-283ea4dd0fb8",
  "external_id": "T1544",
  "domain": "mobile",
  "created": "2020-01-21T15:27:30.182Z",
  "modified": "2026-05-12T15:12:00.623Z",
  "version": "2.2",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [

  ]
}

Explicit source assertions (17)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1216 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--035bdf9a-dc4c-403a-b5c4-9b9b42675122

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15706c6d-803b-4857-9fcb-ce9af2c9d73b

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2024

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1687c7a0-a453-4737-a10d-c57b94d5a458

SecureList OpTriangulation 21Jun2023 · SecureList OpTriangulation 01Jun2023

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25466097-53c6-4dc7-8409-197758e88673

cyble_chameleon_0423

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50e3b570-2e9a-409b-973a-3ce91b9579d4

welivesec_strongpity

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b4128cc-ae1b-4a1b-bc51-d4fdc507bc27

checkpoint_hamas_android_malware · SentinelLabs AridViper 2023 · welivesecurity_apt-c-23

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6176a297-3097-42e2-b1c2-815e7fd8c81c

SecureList - ViceLeaker 2019

ATTACK:mobile:S1126 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84ece53a-eb31-4c2e-9257-a055e0a190c0

fb_arid_viper

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f142643-0448-4b04-8260-8e4e62ad80bb

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1a9db79-4a80-4e65-91bf-72e358d2ce41

nccgroup_sharkbot_0322

ATTACK:mobile:S0326 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a20493e1-4699-405d-a291-c28aae8ed737

Wandera-RedDrop

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3fbcfa8-941f-405a-bd71-a4e082be169f

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0d88891-f927-482e-980a-83d5512b1ae8

ZimperiumOrtegaPratapagiri_GodFather_Jun2025

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0c21324-62e3-46e5-823b-ea0c03a4885d

Lookout-Monokle

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbeff88d-441f-47f9-8afc-60400ee3ab97

lookout_abstractemu_1021

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0a0005e-cc38-4f7a-ba49-21a4c48ae1a1

Bitdefender Mandrake

ATTACK:mobile:S1225 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f44f18d4-4595-4277-9d1e-dd5be6d07a80

TrendMicro_CherryBlos_July2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.