Skip to content

SMS Messages

Subtechnique · ATTACK:mobile:T1636.004

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1636.004",
  "title": "SMS Messages",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1636/004",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c6421411-ae61-42bb-9098-73fddb315002",
  "external_id": "T1636.004",
  "domain": "mobile",
  "created": "2022-04-01T13:25:30.923Z",
  "modified": "2026-05-12T15:12:00.715Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html",
      "external_id": "APP-13"
    }
  ]
}

Explicit source assertions (77)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--035192e3-94f4-426d-9be9-312ddd1ce6a8

SecureList - ViceLeaker 2019

ATTACK:mobile:S0329 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0569a1e0-1eb5-4e87-ae09-b698571012ef

Lookout-StealthMango

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12d14048-793c-456c-a2b8-d812de547ca7

Bleeipng Computer Escobar

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--158f71f5-e24a-4c5b-95d9-6f7e03257052

welivesec_strongpity

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17e94f34-e367-491c-9f9f-79294e124b4f

Palo Alto HenBox

ATTACK:mobile:S0309 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18d3f4c7-2888-4d27-9ac7-b7ade1a1c04c

NYTimes-BackDoor

ATTACK:mobile:S0432 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d828f51-1c04-466c-beaf-2d4de741a544

ATTACK:mobile:S0423 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f7b7de2-10e8-4eec-9c8f-db44ac3f271b

ThreatFabric Ginp

ATTACK:mobile:S0295 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2065382f-45ae-4b9a-a77c-027ecd6c1735

TrendMicro-RCSAndroid

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22334426-e99f-4e97-b4dd-17e297da4118

Lookout Uyghur Campaign

ATTACK:mobile:S0301 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24de6f6e-86d3-4e4e-a965-3e0435205f48

Lookout-Dendroid

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27050442-e578-44b7-9534-ada78824befe

threatfabric_sova_0921

ATTACK:mobile:S0313 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29dc105c-0b1b-4645-85ef-436c096bd3e2

ATTACK:mobile:S1126 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b9a3dc1-5842-458a-97ed-3a1339d10c22

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ebd5c4c-af03-4874-a6fd-1e58d51cc055

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3616bacc-6f6e-41f2-832c-cdbbae9622f3

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36268322-9f5e-4749-8760-6430178a3d68

Cybereason EventBot

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38f96449-dfb1-49db-b0d0-f257c3ee2c5d

Lookout Desert Scorpion

ATTACK:mobile:S0424 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ca284e7-062c-4f23-b95d-9f9c6a2d882a

Kaspersky Triada March 2016

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f171bab-ee60-48ca-860f-7adcdb48b1e0

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--433af79b-ce77-4a4c-84f7-6cdc34e70674

nccgroup_sharkbot_0322

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a77c56b-ed2c-4e43-bd0f-7acf9cce1952

SecurityIntelligence TrickMo

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cc8a16f-562a-42c7-b5d9-10e1088af89c

Talos Gustuff Apr 2019

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e6b726d-9ef4-4eb6-b9a7-74059caee5b7

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e9f021d-3cf4-4790-8f7d-f87f33133446

Sophos Red Alert 2.0

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53044fc0-9bab-46c7-99a3-428ab1795505

MerkleScience_Godfather_April2023

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5706742b-733d-44e9-a032-62b81ba05bcf

Google Project Zero Insomnia

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58c15bce-1593-4be1-ae56-7e7b2634fc56

Threat Fabric Cerberus

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5dd9e0aa-e4dc-4776-9580-5a765c2cc08d

lookout_abstractemu_1021

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6588914f-d270-47d3-b889-046564ad616f

cyble_chameleon_0423

ATTACK:mobile:S1214 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6701f90c-6fce-4f7b-a785-a585601d366a

McAfee MoqHao 2019

ATTACK:mobile:S0304 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68e5789c-9f60-421e-9c79-fae207a29e83

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b64d3f4-96d6-48e5-a57e-b5cf897670f9

Zscaler TikTok Spyware

ATTACK:mobile:S0303 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--721cc30c-74cf-4eed-89a8-7a8e63e6c0e1

Tripwire-MazarBOT

ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75989cf6-c023-4ed3-9d23-a83f55690186

cloudmark_tanglebot_0921

ATTACK:mobile:T1636.004 → subtechnique-of → ATTACK:mobile:T1636

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b45e72f-5741-4942-aa28-ee7abb6f7046

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d481598-ece7-469c-b231-619a804c25e5

Lookout-Pegasus

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82f51cc6-6ce4-459e-b598-7b2b77983469

TrendMicro Coronavirus Updates

ATTACK:mobile:S0298 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--833b4c44-7370-4b27-b9b2-a058c27dcf8c

ATTACK:mobile:S0318 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--834c9a7e-6520-486d-ba60-c3a8b2f9eb1a

TrendMicro-XLoader

ATTACK:mobile:S1128 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8375c6f6-4450-4aa5-ae26-672aecf91d1b

Meta Adversarial Threat Report 2022

ATTACK:mobile:S1054 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c656539-aa1e-42db-9016-d38f1daaae16

cyble_drinik_1022

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90d58c65-acb9-4d7b-89b9-f4b35593c861

BlackBerry Bahamut

ATTACK:mobile:S0320 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--910009da-65c0-4e6a-aeb2-386c643d1c0e

Zscaler-SuperMarioRun

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92cc4942-453e-49af-bc04-18cb99493b73

SecureList OpTriangulation 23Oct2023

ATTACK:mobile:S1243 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9565144c-46b3-4b15-96ba-21cc0dc6d7fd

Lookout_DCHSpy_July2025

ATTACK:mobile:S0292 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--980c49f8-d991-4e1f-8feb-6173e3dfca1f

forcepoint_bitter · Lookout-EnterpriseApps

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1c53fcf-a691-4233-a136-0a51d5a3840f

SWB Exodus March 2019

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2ec4e16-8bc8-4fbf-a71d-d6356fbfc1c5

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a54c8c09-c849-4146-a7cc-158887222a6d

Lookout Uyghur Campaign

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a75ba401-40bf-4bc6-a2f5-01ee44df93a4

K7Dhanalakshmi_VajraSpy_April2022 · ESET_VajraSpy_Feb2024

ATTACK:mobile:S1080 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ada67532-039d-4b4f-93ab-82ceba13ec56

kaspersky_fakecalls_0422

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adfc0dc7-cdb4-44be-b8d5-2292a95ad654

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0625604-e4c4-402b-b191-f43137d38d99

Symantec GoldenCup

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b30fa851-75cf-46ac-aa1b-cfa8b7f36545

securelist rotexy 2018

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b360a1c8-8939-428e-bc6e-3f4755bd9ee0

Threat Fabric Exobot

ATTACK:mobile:S0577 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b43f4cef-138e-4b5d-8e68-e8eeae3591be

Lookout FrozenCell

ATTACK:mobile:S0403 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b641e5b8-5981-452a-99f0-3598c783e5ee

Kaspersky Riltok June 2019

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb83ee25-8875-4806-9f69-ac39bf7cb402

SecureList BusyGasper

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd29ce15-1771-470c-a74b-5ea90832ce23

Lookout Uyghur Campaign

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c340b30d-0ad5-4e90-94ce-b6a6b229a7c4

Cybereason FakeSpy

ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1e11627-23e4-40f3-bcbc-2b832b0bbaa3

proofpoint_flubot_0421

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7ca70d4-2006-4252-b243-e52be760e24d

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc354395-cccf-471a-9335-8538ce20f1ec

lookout_bouldspy_0423

ATTACK:mobile:S0182 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc6514a0-2e9c-4f29-8c15-99e6d382e357

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddca1254-b404-4850-9566-0be35c6d7564

Lookout Uyghur Campaign

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de45db46-2251-4a29-b4d7-3fcf679e9484

CyberMerchants-FlexiSpy · FlexiSpy-Features

ATTACK:mobile:S0305 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0ebf0cd-9244-4cef-9171-128a12b87b58

Zscaler-SpyNote

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e524f30e-11b5-4bd9-83f1-9694e6d8f030

sophos_android_apt_spyware · threatpost AndroidSpyware 2020 · welivesecurity_apt-c-23

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e767fc9e-5211-4e7c-b628-5dd03a24af39

Securelist Asacub

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1208f2a-f2e2-48bd-8fdc-d56b9442f185

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4d5e619-7c83-4845-aecd-de62c33cc0a1

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4e4c3ae-4c4d-4eba-8330-022464cbf828

PaloAlto-SpyDealer

ATTACK:mobile:C0016 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f56b8307-80e3-4d73-869f-1e8b9538dbc4

Cylance Dust Storm

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--faff9f9c-9064-4b3a-bdf9-bbeced2447a6

Lookout ViperRAT

ATTACK:mobile:S0328 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb6458b0-01b8-4c3f-b0f2-ef5d5bd9f6a8

Lookout-StealthMango

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fda8fe32-6121-4b81-9aa0-4e9596db88b1

Bitdefender Mandrake

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.