Skip to content

Native API

Technique · ATTACK:mobile:T1575

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1575",
  "title": "Native API",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1575",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--52eff1c7-dd30-4121-b762-24ae6fa61bbb",
  "external_id": "T1575",
  "domain": "mobile",
  "created": "2020-04-28T14:35:37.309Z",
  "modified": "2026-05-12T15:12:00.633Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion",
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Google NDK Getting Started",
      "url": "https://developer.android.com/ndk/guides"
    },
    {
      "source_name": "MITRE App Vetting Effectiveness",
      "url": "https://www.mitre.org/sites/default/files/publications/pr-16-4772-analyzing-effectiveness-mobile-app-vetting-tools-report.pdf"
    }
  ]
}

Explicit source assertions (11)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01753250-4bfa-4671-bcce-0e3cf19c0ae9

ThreatFabric_Chameleon_Dec2023

ATTACK:mobile:S0545 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a2e4b01-e78f-4c05-b157-c6714d34fddb

WhiteOps TERRACOTTA

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29703cf5-5f27-4a96-a27b-983bc1c2d5c7

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4920a041-86f7-495b-896c-4d964950ed7e

Palo Alto HenBox

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--494d08df-ad69-49c4-890a-fb8dd3025491

ZimperiumOrtegaPratapagiri_GodFather_Jun2025

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6294e276-e4ac-4097-a5cd-3b81e0d4498f

Securelist Asacub

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66c7fdcf-b9ef-429e-81b2-e97e971cfb42

Lookout Uyghur Campaign

ATTACK:mobile:S0555 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91831379-b0da-4019-a7bb-17e53cda9d0b

CYBERWARCON CHEMISTGAMES

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0f009b5-cf5e-4333-a969-03adbe4de3ee

SecureList OpTriangulation 23Oct2023 · SecureList OpTriangulation Dec2023

ATTACK:mobile:S0432 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c49cdcb7-3cb8-40ed-a745-0cebad20b1fd

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1575

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1c06c38-0f58-4789-9758-1e321394e03f

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.