T1420: File and Directory Discovery
Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including deciding if the adversary should fully infect the target and/or attempt specific actions.
On Android, Linux file permissions and SELinux policies typically stringently restrict what can be accessed by apps without taking advantage of a privilege escalation exploit. The contents of the external storage directory are generally visible, which could present concerns if sensitive data is inappropriately stored there. iOS's security architecture generally restricts the ability to perform any type of File and Directory Discovery without use of escalated privileges.
Analyst context for executives and security teams
File and Directory Discovery on mobile devices is a reconnaissance behavior where malicious code looks through accessible storage to find useful files or decide what to do next. For leaders, the practical issue is not just discovery itself, but what it reveals about mobile data handling: sensitive files placed in broadly visible Android external storage, unmanaged device storage, or devices with escalated privileges can turn a compromised app into a business data exposure path.
Executive priority
Prioritize this technique where mobile devices handle regulated, executive, operational, or customer data. The ATT&CK object highlights Android and iOS, with Android external storage as a particular concern and iOS discovery generally constrained unless privileges are escalated. Executives should ask whether mobile OS currency, application data storage practices, and mobile telemetry are sufficient to prove control effectiveness during an incident or audit.
Technical view
SOC, mobile security, and IR teams should validate whether they can observe suspicious file enumeration on Android and iOS endpoints, especially from untrusted, newly installed, or unexpected apps. Because MITRE provides no official detection text for this technique, detection engineering should be based on local mobile telemetry and the related ATT&CK detection strategy DET0682. The relationship set shows this behavior across multiple Android malware families and an iOS implant, so defenders should test coverage across both mobile platforms rather than treating it as Android-only.
Likely telemetry
- Mobile EDR or MTD alerts for suspicious filesystem access or enumeration
- Android application permission and storage access data
- Android external storage access events where available
- iOS device security telemetry, especially indicators of elevated privileges or abnormal app behavior
- Mobile device management inventory, OS version, jailbreak/root status, and installed application history
Detection direction
- Confirm whether DET0682 or equivalent local analytics are implemented and mapped to T1420.
- Tune detections around unusual volume, breadth, or location of file and directory access rather than single benign file reads.
- Prioritize alerts where discovery is performed by apps with suspicious provenance, unnecessary permissions, recent installation, or other malware-like behavior.
- On Android, pay special attention to access to external storage because MITRE notes it is generally visible and may expose sensitive data if stored there inappropriately.
- On iOS, treat filesystem discovery signals as higher concern when paired with evidence of escalated privileges, since MITRE notes iOS normally restricts this behavior.
Mitigation priorities
- Maintain recent Android and iOS versions, aligning with ATT&CK mitigation M1006, because newer mobile OS releases include vulnerability patches and security architecture improvements.
- Reduce sensitive data stored in broadly accessible mobile locations, especially Android external storage.
- Enforce mobile device management baselines for OS currency, application inventory, and root or jailbreak detection.
- Review enterprise mobile applications for secure local storage practices and least-necessary file access.
- Use mobile threat detection or equivalent telemetry where business risk justifies monitoring beyond basic MDM inventory.
Analyst notes and limits
ATT&CK v19.1 lists this as mobile technique T1420 for Android and iOS. MITRE does not specify tactics for this object and does not provide official detection guidance. Relationships document use by multiple campaigns, a group, and many software entries, including Android surveillanceware/RATs/banking malware and the iOS TriangleDB implant. These relationships support prioritizing mobile visibility, but they do not by themselves prove current exposure or attribution in any environment.
This take is limited to the supplied ATT&CK fields, external references, and relationships. No vendor-specific detections, procedure details, or guaranteed telemetry sources are provided by MITRE in the supplied object. Actual detectability depends on device ownership model, MDM/MTD/EDR deployment, OS version, app sandboxing, privacy constraints, and whether mobile forensic collection is available.
File and Directory Discovery
Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including deciding if the adversary should fully infect the target and/or attempt specific actions.
On Android, Linux file permissions and SELinux policies typically stringently restrict what can be accessed by apps without taking advantage of a privilege escalation exploit. The contents of the external storage directory are generally visible, which could present concerns if sensitive data is inappropriately stored there. iOS's security architecture generally restricts the ability to perform any type of File and Directory Discovery without use of escalated privileges.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0112: Windshift
S0551: GoldenEagle
GoldenEagle is a piece of Android malware that has been used in targeting of Uyghurs, Muslims, Tibetans, individuals in Turkey, and individuals in China. Samples have been found as early as 2012.[1]
S0505: Desert Scorpion
Desert Scorpion is surveillanceware that has targeted the Middle East, specifically individuals located in Palestine. Desert Scorpion is suspected to have been operated by the threat actor APT-C-23.[1]
There are multiple close variants of Desert Scorpion, such as VAMP[2], GnatSpy[3], FrozenCell and SpyC23, which add some additional functionality but are not significantly different from the original malware.
S9005: DocSwap
DocSwap is an Android malware first identified in 2025, and attributed to Kimsuky. DocSwap’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on DocSwap’s name and Korean-language strings, DocSwap potentially targets mobile device users in South Korea. Several variants of DocSwap exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.[1][2]
S0549: SilkBean
S1225: CherryBlos
CherryBlos is an Android malware that steals credentials and redirects cryptocurrency to adversary-controlled wallets. CherryBlos was labelled Robot 999 in its first appearance in April 2023; since then, various aliases have been used, including GPTalk, Happy Miner, and SynthNet. The threat actors behind CherryBlos uploaded the malware to different Google Play regions, such as Malaysia, Vietnam, Indonesia, Philippines, Uganda, and Mexico.[1]
S1095: AhRat
AhRat is an Android remote access tool based on the open-source AhMyth remote access tool. AhRat initially spread in August 2022 on the Google Play Store via an update containing malicious code to the previously benign application, “iRecorder – Screen Recorder,” which itself was released in September 2021.[1]
S9030: SameCoin
S1077: Hornbill
S1216: TriangleDB
TriangleDB is an Objective-C written implant deployed after Binary Validator and after root privileges are obtained during Operation Triangulation’s infection chain. Upon execution, TriangleDB communicates with the C2 server, relaying information about the victim device.[1]
S9006: VajraSpy
VajraSpy is Android malware distributed via trojanized messaging and news applications. It has been used to target individuals in Pakistan and India since at least 2021 and has been delivered through the Google Play Store, malicious domains, and other uncontrolled distribution channels. VajraSpy is attributed with high confidence to Patchwork which has used the malware to conduct targeted espionage, primarily against devices in Pakistan.[1][2][3]
S0535: Golden Cup
Golden Cup is Android spyware that has been used to target World Cup fans.[1]
S0577: FrozenCell
FrozenCell is the mobile component of a family of surveillanceware, with a corresponding desktop component known as KasperAgent and Micropsia.[1]
There are multiple close variants of FrozenCell, such as VAMP[2], GnatSpy[3], Desert Scorpion and SpyC23, which add some additional functionality but are not significantly different from the original malware.
C0033: C0033
C0033 was a PROMETHIUM campaign during which they used StrongPity to target Android users. C0033 was the first publicly documented mobile campaign for PROMETHIUM, who previously used Windows-based techniques.[1]
C0054: Operation Triangulation
Operation Triangulation is a mobile campaign targeting iOS devices.[1] The unidentified actors used zero-click exploits in iMessage attachments to gain Initial Access, then executed exploits and validators, such as Binary Validator before finally executing the TriangleDB implant.
C0016: Operation Dust Storm
Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the Operation Dust Storm threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.[1]
Operation Dust Storm threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | d6df1dfa9a1b… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
NIST Mobile Threat Catalogue STA-41Open source URL
-
[2]
mitre-attack T1420Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.