Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1406: Obfuscated Files or Information

Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Portions of files can also be encoded to hide the plaintext strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.[1]

MobileT1406TechniqueObject v3.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Obfuscated Files or Information matters because mobile threats can hide payloads, strings, or functionality so that normal inspection, signature checks, and analyst review miss what an app or file will do. For Android and iOS risk owners, this is a coverage question: can the organization see suspicious mobile content before installation, during analysis, and when code or data is unpacked, decoded, reassembled, or moved in transit?

Executive priority

Treat this as a mobile security assurance and incident-readiness issue, not just a malware-analysis detail. The supplied ATT&CK relationships show this technique is associated with many mobile malware families and with sub-techniques for steganography and software packing. Leaders should ask whether mobile app vetting, device security telemetry, SOC triage, and IR processes can produce evidence when apps use encrypted, encoded, compressed, packed, or split payloads—especially for regulated users, executives, finance users, or operational teams relying on mobile devices.

Technical view

For SOC, detection engineering, and IR teams, validate coverage across Android and iOS for files or payloads that are compressed, archived, encrypted, encoded, packed, split across benign-looking files, hidden in media, or revealed only after runtime unpacking. ATT&CK provides no official detection text for T1406, but relationship context includes DET0720, Detection of Obfuscated Files or Information, and sub-techniques T1406.001 Steganography and T1406.002 Software Packing. Testing should therefore include both static analysis limitations and dynamic/runtime visibility, with attention to false positives from legitimate compression, encryption, app protection, and media handling.

Likely telemetry

  • Mobile application package and file metadata from Android and iOS app vetting or security tooling
  • Static analysis indicators such as encoded strings, encrypted resources, archives, packed executables, or unusual file structure
  • Dynamic analysis or runtime observations showing unpacked/decrypted code or reassembled payloads
  • Device security logs for suspicious file creation, modification, or staging patterns where available
  • Network or proxy evidence for encoded, encrypted, compressed, or otherwise unusual payload transfer, where collection is permitted

Detection direction

  • Validate whether mobile detections rely too heavily on signatures or plaintext strings, because this technique is explicitly used to make files and payloads harder to discover or analyze.
  • Tune analytics to distinguish routine app compression/encryption from suspicious combinations such as hidden payloads, split files, runtime unpacking, or concealed strings.
  • Include sub-technique context: steganography may require media-content review, while software packing may require runtime or memory-aware analysis rather than static inspection alone.
  • Use relationship context for prioritization: ATT&CK maps T1406 to multiple Android malware families and at least one iOS-related software entry, so detection assumptions should be tested across both supported platforms.
  • Because official MITRE detection guidance is not provided, document local data sources, gaps, and analyst decision criteria as part of detection engineering evidence.

Mitigation priorities

  • Prioritize mobile app intake and vetting controls that can inspect packaged, compressed, encrypted, encoded, or split content before broad deployment or user exposure.
  • Require dynamic analysis or sandbox-style review for higher-risk mobile apps when static analysis is inconclusive due to packing or obfuscation.
  • Maintain mobile device security telemetry and incident response procedures that preserve suspicious files, app packages, network indicators, and runtime observations for analysis.
  • Use policy and governance controls to limit installation of untrusted or unreviewed apps, especially for high-risk roles and sensitive business processes.
  • For compliance readiness, retain evidence showing how mobile applications are reviewed, how obfuscation findings are triaged, and how exceptions are approved.
Analyst notes and limits

This take is based on ATT&CK T1406 for the mobile domain, platforms Android and iOS, the official description, the Microsoft MalLockerB and NIST Mobile Threat Catalogue references, and the supplied relationships. The object has no ATT&CK tactics specified and no official detection text, so defensive guidance is framed as validation direction rather than guaranteed coverage.

Local conclusions require environment evidence: mobile fleet composition, app sources, MDM or mobile security tooling, network visibility, privacy constraints, and current app-analysis capabilities. The supplied fields support that the behavior is used to evade discovery or analysis, but they do not by themselves prove active exploitation, customer exposure, or existing detection coverage.

Official MITRE ATT&CK definition

Obfuscated Files or Information

Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Portions of files can also be encoded to hide the plaintext strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
Domain ID Name Relationship / procedure
Mobile T1406.002 Software Packing Sub-technique Software Packing subtechnique of this object.
Mobile T1406.001 Steganography Sub-technique Steganography subtechnique of this object.
Associated objects

Groups, software, and campaigns

Group Mobile

G0112: Windshift

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.[1][2][3]

Malware Mobile

S9005: DocSwap

DocSwap is an Android malware first identified in 2025, and attributed to Kimsuky. DocSwap’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on DocSwap’s name and Korean-language strings, DocSwap potentially targets mobile device users in South Korea. Several variants of DocSwap exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.[1][2]

Android
Malware Mobile

S9004: Crocodilus

Crocodilus is an Android banking Trojan that was discovered in March 2025. Crocodilus targeted users worldwide, including Turkey, Poland, Argentina, Brazil, Spain, the United States, Indonesia and India. Crocodilus has been customized based on the target location. For example, Crocodilus mimicked major Turkish and Spanish banks for users in Turkey and Spain, while users in Poland saw Facebook advertisements that promoted Crocodilus to claim bonus points.[1][2]

Android
Malware Mobile

S1061: AbstractEmu

AbstractEmu is mobile malware that was first seen in Google Play and other third-party stores in October 2021. It was discovered in 19 Android applications, of which at least 7 abused known Android exploits for obtaining root permissions. AbstractEmu was observed primarily impacting users in the United States, however victims are believed to be across a total of 17 countries.[1]

Android
Malware Mobile

S0407: Monokle

Monokle is targeted, sophisticated mobile surveillanceware. It is developed for Android, but there are some code artifacts that suggests an iOS version may be in development.[1]

Android
Malware Mobile

S0549: SilkBean

SilkBean is a piece of Android surveillanceware containing comprehensive remote access tool (RAT) functionality that has been used in targeting of the Uyghur ethnic group.[1]

Android
Malware Mobile

S0432: Bread

Bread was a large-scale billing fraud malware family known for employing many different cloaking and obfuscation techniques in an attempt to continuously evade Google Play Store’s malware detection. 1,700 unique Bread apps were detected and removed from the Google Play Store before being downloaded by users.[1]

Android
Malware Mobile

S0480: Cerberus

Cerberus is a banking trojan whose usage can be rented on underground forums and marketplaces. Prior to being available to rent, the authors of Cerberus claim was used in private operations for two years.[1]

Android
Relationship explorer

All related ATT&CK context

uses · Malware S9005: DocSwap Mobile uses · Malware S9004: Crocodilus Mobile uses · Malware S0545: TERRACOTTA Mobile uses · Malware S1061: AbstractEmu Mobile uses · Malware S0406: Gustuff Mobile uses · Malware S0407: Monokle Mobile uses · Malware S0524: AndroidOS/MalLocker.B Mobile uses · Malware S0549: SilkBean Mobile uses · Malware S0432: Bread Mobile uses · Malware S0463: INSOMNIA Mobile uses · Malware S0399: Pallas Mobile uses · Malware S0480: Cerberus Mobile uses · Malware S1056: TianySpy Mobile uses · Campaign C0033: C0033 Mobile uses · Malware S1185: LightSpy Mobile uses · Malware S0540: Asacub Mobile uses · Malware S1067: FluBot Mobile uses · Malware S1095: AhRat Mobile uses · Malware S0544: HenBox Mobile uses · Malware S1094: BRATA Mobile uses · Malware S0421: GolfSpy Mobile subtechnique of · Technique T1406.002: Software Packing Mobile uses · Malware S0555: CHEMISTGAMES Mobile detects · Detection Strategy DET0720: Detection of Obfuscated Files or Information Mobile
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
3.1
Created
Modified
Raw hash
dca913b93ba929d0...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 3.1 Current bundle dca913b93ba9…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft MalLockerB

    D. Venkatesan. (2020, October 8). Sophisticated new Android malware marks the latest evolution of mobile ransomware . Retrieved October 29, 2020.

    Open source URL
  2. [2]
    NIST Mobile Threat Catalogue APP-21
    Open source URL
  3. [3]
    mitre-attack T1406
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use