Skip to content

Match Legitimate Name or Location

Subtechnique · ATTACK:mobile:T1655.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1655.001",
  "title": "Match Legitimate Name or Location",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1655/001",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--114fed8b-7eed-4136-8b9c-411c5c7fff4b",
  "external_id": "T1655.001",
  "domain": "mobile",
  "created": "2023-07-12T20:45:14.704Z",
  "modified": "2026-05-12T15:12:00.621Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-14.html",
      "external_id": "APP-14"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html",
      "external_id": "APP-31"
    }
  ]
}

Explicit source assertions (48)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--068c3d23-8aa2-48e9-acb3-c72651c94f0b

trendmicro_strongpity

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07c727a6-6323-477a-bb55-34e130959b4e

Bitdefender Mandrake

ATTACK:mobile:S0314 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--117a7e1e-d5dc-451d-ab79-f29bdfec40ae

CrowdStrike-Android

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11a1da8f-f0db-4abe-88bb-1ab06f271f3f

Lookout ViperRAT

ATTACK:mobile:S1214 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--268c2962-a557-4782-a40b-eef430c87740

McAfee MoqHao 2019

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f63c5a0-db78-4f81-bbdd-46fccf06bf9c

MerkleScience_Godfather_April2023

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fdcc49e-1875-4618-b3c5-c0ecfab97386

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37d14338-b629-4b54-b734-446789b79f6f

Cybereason EventBot

ATTACK:mobile:S0320 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c57ee56-34bc-4f0c-b363-68dab3e5e7b3

Proofpoint-Droidjack

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42510b9a-7e72-4a52-bc7a-6e1a7ebacff7

cyble_chameleon_0423 · ThreatFabric_Chameleon_Dec2023

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--533e5ce5-138c-4bfc-9a59-eb0ced8e6e1a

Lookout Uyghur Campaign

ATTACK:mobile:S0555 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6588186c-2fa1-408d-bef4-2d63ccf49c28

CYBERWARCON CHEMISTGAMES

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6609b892-d388-4b8a-ac21-5cbf12e0d574

Forbes Cerberus

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--697f5584-667f-4489-a535-586dd1a8b48c

Lookout Uyghur Campaign

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a1d8b2f-9007-46ba-b559-356b81632cee

Zscaler TikTok Spyware

ATTACK:mobile:S1126 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a924f93-6a3a-4931-b0b3-b8bc37f0587a

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e811d89-6526-480f-be40-1ad6483182ff

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73410b22-5aca-4b86-8efc-98c1ad75399a

ATTACK:mobile:S0301 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--746eaf98-bd95-4e9a-a4ed-0e3f20402276

Lookout-Dendroid

ATTACK:mobile:S0525 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--760037f0-f027-41bb-adf8-1ced6c7085be

WeLiveSecurity AdDisplayAshas

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76f852f3-f218-40e2-8fa1-6fb15c4cbf98

Sophos Red Alert 2.0

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82e93a9e-6968-497f-8043-a08d0f35bd32

Trend Micro Anubis · Cofense Anubis

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83358774-0857-429c-9f7a-151403e52881

Threat Fabric Exobot

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8499ffce-1045-4a8a-9e09-ec53d535a021

Palo Alto HenBox

ATTACK:mobile:G0097 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84dbe7c6-421b-4bfb-b022-6c585c2e50c4

Trend Micro Bouncing Golf 2019

ATTACK:mobile:T1655.001 → subtechnique-of → ATTACK:mobile:T1655

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88de8869-2b01-4702-8518-e4e78fde44d9

ATTACK:mobile:S0423 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e67f2e0-65da-4d27-9d41-e2f9a174331b

ThreatFabric Ginp

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98aee077-156a-4d11-94fe-b5b7c4945ff9

mcafee_brata_0421 · securelist_brata_0819

ATTACK:mobile:G1019 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a575420-cdce-4a9f-9ea9-2ae5c469cad9

MoustachedBouncer ESET August 2023

ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ac05264-8d82-4a84-a4ab-db80638f09f4

ESETStefanko_NGateVariant_Apr2026

ATTACK:mobile:G1028 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2ca7663-5ce0-447f-beeb-ad0f66a1a1e7

checkpoint_hamas_android_malware · sophos_android_apt_spyware · welivesecurity_apt-c-23

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0bade50-bcca-4924-9746-c4ed0c3be76c

lookout_bouldspy_0423

ATTACK:mobile:S0577 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2277deb-0ddb-45a7-9690-4a2168e1026b

Lookout FrozenCell

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3a14001-e0c0-4f13-ac03-04e56dc0e312

Lookout Uyghur Campaign

ATTACK:mobile:S1080 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b43c87a7-de40-4673-9808-57c7ffca7b98

kaspersky_fakecalls_0422

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc870a55-5499-4146-91ef-ea74647c3e10

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd6f13e7-9d64-4d88-adf0-d49afdc0370b

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c16c7904-3c85-49de-a0f4-872f4227d775

SecureList - ViceLeaker 2019

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4d71eb8-2099-44b9-be45-758f9e6a771a

Securelist Asacub

ATTACK:mobile:S0419 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c546dd04-2060-44bf-ba1e-d1c1edc54687

CheckPoint SimBad 2019

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c773998e-a140-4498-827a-573df96e4331

checkpoint_hamas_android_malware · Cyware APT-C-23 2020 · SentinelLabs AridViper 2023 · sophos_android_apt_spyware · threatpost AndroidSpyware 2020 · welivesecurity_apt-c-23

ATTACK:mobile:S0292 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cce1848e-5f32-429a-8c9d-e32367052675

blackberry_mobile_malware_apt_esp · forcepoint_bitter

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d39ceb9c-ef0c-4820-b363-dc8ce0f0d00c

Cybereason FakeSpy

ATTACK:mobile:S0440 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df07166f-917e-4bc4-899e-d689d1d3f785

CheckPoint Agent Smith

ATTACK:mobile:S0318 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e245ad04-3fe9-4132-8bb4-77cdc4c3a1eb

TrendMicro-XLoader-FakeSpy

ATTACK:mobile:S1243 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--edf758e1-600e-4b7e-94eb-6c76b9a5ca6a

Lookout_DCHSpy_July2025

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef792cb5-cb1f-4871-a2ef-20e6150d4005

Lookout Uyghur Campaign

ATTACK:mobile:S0524 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff55feec-669d-4199-a05c-e8dfaebaaf8f

Microsoft MalLockerB

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.