LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1422: System Network Configuration Discovery

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of devices they access or through information discovery of remote systems.

Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

On Android, details of onboard network interfaces are accessible to apps through the `java.net.NetworkInterface` class.[1] Previously, the Android `TelephonyManager` class could be used to gather telephony-related device identifiers, information such as the IMSI, IMEI, and phone number. However, starting with Android 10, only preloaded, carrier, the default SMS, or device and profile owner applications can access the telephony-related device identifiers.[2]

On iOS, gathering network configuration information is not possible without root access.

Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

MobileT1422TechniqueObject v2.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

System Network Configuration Discovery matters because mobile malware or implants can use basic network details, such as IP or MAC address information, to understand where a device sits and decide what to do next. For executives and security leaders, the risk is not the discovery action alone; it is that mobile device context can help an adversary adapt follow-on activity, including connectivity checks, Wi-Fi-related discovery, or command-and-control preparation.

Executive priority

Treat this as a mobile security and incident-response readiness issue. Leadership should ask whether Android and iOS devices that handle sensitive business data are kept on recent OS versions, whether jailbroken/rooted devices are controlled, and whether the SOC can investigate suspicious mobile applications that collect network configuration information. This technique is associated in ATT&CK with multiple Android and iOS malware/software entries and with Operation Triangulation, so mobile telemetry and device hygiene should be part of resilience and audit evidence discussions where mobile devices are in scope.

Technical view

For Android, validate visibility into applications accessing network interface details through normal platform APIs such as java.net.NetworkInterface, and account for Android 10+ restrictions around telephony identifiers through TelephonyManager. For iOS, ATT&CK notes that gathering network configuration information is not possible without root access, making jailbreak/root indicators and unusual privilege context important investigative pivots. Because ATT&CK provides no official detection text for T1422, detection engineering should use the related DET0634 strategy as a starting point and enrich it with local mobile EDR/MDM, application inventory, OS version, permission, network, and jailbreak/root evidence. Subtechniques T1422.001 Internet Connection Discovery and T1422.002 Wi-Fi Discovery should be reviewed together because they represent common adjacent discovery behaviors.

Likely telemetry

  • Mobile device OS version and patch level from MDM/UEM
  • Installed mobile application inventory and application provenance
  • Mobile security/EDR alerts for suspicious app behavior
  • Android application behavior involving network interface or telephony-related API access where available
  • Permission, device owner/profile owner, default SMS app, carrier/preloaded app status on Android

Detection direction

  • Validate whether DET0634 or equivalent local analytics are implemented for mobile network configuration discovery behavior.
  • Tune Android detections to distinguish expected network-aware apps from suspicious or unexpected collection of device/network identifiers.
  • Use OS version context because Android 10+ restricts access to telephony-related device identifiers to specific application categories.
  • On iOS, prioritize alerts involving jailbreak/root conditions or suspicious privileged execution because ATT&CK states network configuration gathering is not possible without root access.
  • Correlate this technique with Internet Connection Discovery and Wi-Fi Discovery rather than treating isolated network-detail collection as high confidence by itself.

Mitigation priorities

  • Prioritize M1006: keep mobile operating systems on recent versions to benefit from security architecture improvements and restrictions on sensitive identifier access.
  • Enforce mobile device compliance policies for OS version, patch level, and device integrity before allowing access to business resources.
  • Restrict or remove rooted/jailbroken devices from sensitive workflows, especially for iOS where root access materially changes feasibility.
  • Maintain application governance through approved app sources, app inventory, and review of apps requesting sensitive or unusual capabilities.
  • Ensure incident response playbooks include mobile evidence collection, application triage, and decisions for containment or device re-enrollment.
Additional notes and limits

This technique is a discovery behavior, so its value is usually in context: which app performed it, on what platform and OS version, whether the device was rooted or jailbroken, and what happened before or after. The relationship set includes Android and iOS malware/software examples, a campaign relationship, a detection strategy relationship, a mitigation relationship, and two subtechniques, which supports prioritizing mobile telemetry correlation rather than single-signal alerting.

ATT&CK does not provide official detection text or tactics for this object in the supplied fields. The available fields support Android and iOS platform discussion, Android API considerations, Android 10+ telephony identifier restrictions, and iOS root-access constraints, but they do not establish customer exposure, active exploitation, or guaranteed detection coverage. Local MDM, mobile EDR, application, and network evidence is required to assess risk and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

System Network Configuration Discovery

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of devices they access or through information discovery of remote systems.

Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

On Android, details of onboard network interfaces are accessible to apps through the `java.net.NetworkInterface` class.[1] Previously, the Android `TelephonyManager` class could be used to gather telephony-related device identifiers, information such as the IMSI, IMEI, and phone number. However, starting with Android 10, only preloaded, carrier, the default SMS, or device and profile owner applications can access the telephony-related device identifiers.[2]

On iOS, gathering network configuration information is not possible without root access.

Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
DomainIDNameRelationship / procedure
MobileT1422.002Wi-Fi DiscoverySub-techniqueWi-Fi Discovery subtechnique of this object.
MobileT1422.001Internet Connection DiscoverySub-techniqueInternet Connection Discovery subtechnique of this object.
Associated objects

Groups, software, and campaigns

GroupMobile

G1028: APT-C-23

APT-C-23 is a threat group that has been active since at least 2014.[1] APT-C-23 has primarily focused its operations on the Middle East, including Israeli military assets. APT-C-23 has developed mobile spyware targeting Android and iOS devices since 2017.[2]

MalwareMobile

S0509: FakeSpy

FakeSpy is Android spyware that has been operated by the Chinese threat actor behind the Roaming Mantis campaigns.[1]

Android
MalwareMobile

S0427: TrickMo

TrickMo a 2FA bypass mobile banking trojan, most likely being distributed by TrickBot. TrickMo has been primarily targeting users located in Germany.[1]

TrickMo is designed to steal transaction authorization numbers (TANs), which are typically used as one-time passwords.[1]

Android
MalwareMobile

S1061: AbstractEmu

AbstractEmu is mobile malware that was first seen in Google Play and other third-party stores in October 2021. It was discovered in 19 Android applications, of which at least 7 abused known Android exploits for obtaining root permissions. AbstractEmu was observed primarily impacting users in the United States, however victims are believed to be across a total of 17 countries.[1]

Android
MalwareMobile

S0311: YiSpecter

YiSpecter is a family of iOS and Android malware, first detected in November 2014, targeting users in mainland China and Taiwan. YiSpecter abuses private APIs in iOS to infect both jailbroken and non-jailbroken devices.[1]

AndroidiOS
MalwareMobile

S0329: Tangelo

Tangelo is iOS malware that is believed to be from the same developers as the Stealth Mango Android malware. It is not a mobile application, but rather a Debian package that can only run on jailbroken iOS devices. [1]

iOS
MalwareMobile

S9005: DocSwap

DocSwap is an Android malware first identified in 2025, and attributed to Kimsuky. DocSwap’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on DocSwap’s name and Korean-language strings, DocSwap potentially targets mobile device users in South Korea. Several variants of DocSwap exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.[1][2]

Android
Relationship explorer

All related ATT&CK context

uses · MalwareS0509: FakeSpyMobileuses · MalwareS1082: SunbirdMobileuses · MalwareS0403: RiltokMobileuses · MalwareS1077: HornbillMobileuses · MalwareS0427: TrickMoMobileuses · MalwareS1061: AbstractEmuMobileuses · MalwareS0489: WolfRATMobileuses · MalwareS0311: YiSpecterMobileuses · GroupG1028: APT-C-23Mobileuses · MalwareS0313: RuMMSMobileuses · MalwareS0490: XLoader for iOSMobileuses · MalwareS0329: TangeloMobileuses · MalwareS9005: DocSwapMobileuses · MalwareS0478: EventBotMobileuses · CampaignC0054: Operation TriangulationMobilemitigates · MitigationM1006: Use Recent OS VersionMobileuses · MalwareS1079: BOULDSPYMobileuses · MalwareS0536: GPlayedMobileuses · MalwareS0535: Golden CupMobileuses · MalwareS0577: FrozenCellMobileuses · MalwareS0463: INSOMNIAMobileuses · MalwareS0315: DualToyMobileuses · MalwareS0540: AsacubMobileuses · MalwareS0291: PJAppsMobile
Mitigations

Mitigation direction

MitigationMobile

M1006: Use Recent OS Version

New mobile operating system versions bring not only patches against discovered vulnerabilities but also often bring security architecture improvements that provide resilience against potential vulnerabilities or weaknesses that have not yet been discovered. They may also bring improvements that block use of observed adversary techniques.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.4
Created
Modified
Raw hash
6b96df9aa4008b03...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.4Current bundle6b96df9aa400…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    NetworkInterface

    Android. (n.d.). NetworkInterface. Retrieved December 21, 2016.

    Open source URL
  2. [2]
    TelephonyManager

    Android. (n.d.). TelephonyManager. Retrieved December 21, 2016.

    Open source URL
  3. [3]
    Cybereason FakeSpy

    O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.

    Open source URL
  4. [4]
    lookout_hornbill_sunbird_0221

    Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.

    Open source URL
  5. [5]
    Kaspersky Riltok June 2019

    Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.

    Open source URL
  6. [6]
    SecurityIntelligence TrickMo

    P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.

    Open source URL
  7. [7]
    lookout_abstractemu_1021

    P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023.

    Open source URL
  8. [8]
    Talos-WolfRAT

    W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.

    Open source URL
  9. [9]
    paloalto_yispecter_1015

    Claud Xiao. (2015, October 4). YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs. Retrieved March 3, 2023.

    Open source URL
  10. [10]
    checkpoint_hamas_android_malware

    CheckPoint Research. (2020, February 16). Hamas Android Malware On IDF Soldiers-This is How it Happened. Retrieved November 17, 2024.

    Open source URL
  11. [11]
    FireEye-RuMMS

    Wu Zhou, Deyu Hu, Jimmy Su, Yong Kang. (2016, April 26). RUMMS: THE LATEST FAMILY OF ANDROID MALWARE ATTACKING USERS IN RUSSIA VIA SMS PHISHING. Retrieved February 6, 2017.

    Open source URL
  12. [12]
    TrendMicro-XLoader-FakeSpy

    Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.

    Open source URL
  13. [13]
    Lookout-StealthMango

    Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.

    Open source URL
  14. [14]
    EnkiWhiteHat_KimsukyDOCSWAP_Dec2025

    EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026.

    Open source URL
  15. [15]
    Cybereason EventBot

    D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.

    Open source URL
  16. [16]
    SecureList OpTriangulation 21Jun2023

    Kucherin, G., et al. (2023, June 21). Dissecting TriangleDB, a Triangulation spyware implant. Retrieved April 18, 2024.

    Open source URL
  17. [17]
    lookout_bouldspy_0423

    Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.

    Open source URL
  18. [18]
    Talos GPlayed

    V. Ventura. (2018, October 11). GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.

    Open source URL
  19. [19]
    Symantec GoldenCup

    R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.

    Open source URL
  20. [20]
    Lookout FrozenCell

    Michael Flossman. (2017, October 5). FrozenCell: Multi-platform surveillance campaign against Palestinians. Retrieved November 11, 2020.

    Open source URL
  21. [21]
    Google Project Zero Insomnia

    I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.

    Open source URL
  22. [22]
    PaloAlto-DualToy

    Claud Xiao. (2016, September 13). DualToy: New Windows Trojan Sideloads Risky Apps to Android and iOS Devices. Retrieved January 24, 2017.

    Open source URL
  23. [23]
    Securelist Asacub

    T. Shishkova. (2018, August 28). The rise of mobile banker Asacub. Retrieved December 14, 2020.

    Open source URL
  24. [24]
    Lookout-EnterpriseApps

    Lookout. (2016, May 25). 5 active mobile threats spoofing enterprise apps. Retrieved December 19, 2016.

    Open source URL
  25. [25]
    SWB Exodus March 2019

    Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024.

    Open source URL
  26. [26]
    LinkedIn Dmitry LightSpy 2025

    Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.

    Open source URL
  27. [27]
    Google Bread

    A. Guertin, V. Kotov, Android Security & Privacy Team. (2020, January 9). PHA Family Highlights: Bread (and Friends) . Retrieved April 27, 2020.

    Open source URL
  28. [28]
    Lookout Uyghur Campaign

    A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.

    Open source URL
  29. [29]
    TrendMicro-Anserver2

    Karl Dominguez. (2011, September 27). ANDROIDOS_ANSERVER.A. Retrieved November 30, 2018.

    Open source URL
  30. [30]
    Lookout-Monokle

    Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.

    Open source URL
  31. [31]
    Talos Gustuff Apr 2019

    Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.

    Open source URL
  32. [32]
    MerkleScience_Godfather_April2023

    Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025.

    Open source URL
  33. [33]
    TrendMicro Coronavirus Updates

    T. Bao, J. Lu. (2020, April 14). Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.

    Open source URL
  34. [34]
    Lookout ViperRAT

    M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.

    Open source URL
  35. [35]
    Threat Fabric Exobot

    Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.

    Open source URL
  36. [36]
    forcepoint_bitter

    Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved March 1, 2024.

    Open source URL
  37. [37]
    Wandera-RedDrop

    Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved November 17, 2024.

    Open source URL
  38. [38]
    securelist rotexy 2018

    T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.

    Open source URL
  39. [39]
    SecureList OpTriangulation 23Oct2023

    Kucherin, G., et al. (2023, October 23). The outstanding stealth of Operation Triangulation. Retrieved April 18, 2024.

    Open source URL
  40. [40]
    WhiteOps TERRACOTTA

    Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.

    Open source URL
  41. [41]
    McAfee MoqHao 2019

    Pak, C. (2019, August 7). MoqHao Related Android Spyware Targeting Japan and Korea Found on Google Play. Retrieved November 13, 2024.

    Open source URL
  42. [42]
    Lookout-PegasusAndroid

    Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.

    Open source URL
  43. [43]
    trendmicro_tianyspy_0122

    Trend Micro. (2022, January 25). TianySpy Malware Uses Smishing Disguised as Message From Telco. Retrieved January 11, 2023.

    Open source URL
  44. [44]
    ZimperiumGupta_RatMilad_Oct2022

    Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.

    Open source URL
  45. [45]
    PaloAlto-SpyDealer

    Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.

    Open source URL
  46. [46]
    Trend Micro FlyTrap

    Trend Micro. (2021, August 17). FlyTrap Android Malware Is Taking Over Facebook Accounts — Protect Yourself With a Malware Scanner. Retrieved September 28, 2023.

    Open source URL
  47. [47]
    NetworkInterface

    Android. (n.d.). NetworkInterface. Retrieved December 21, 2016.

    Open source URL
  48. [48]
    TelephonyManager

    Android. (n.d.). TelephonyManager. Retrieved December 21, 2016.

    Open source URL
  49. [49]
    mitre-attackT1422
    Open source URL
  50. [50]
    mitre-attackT1422
    Open source URL
  51. [51]
    lookout_hornbill_sunbird_0221

    Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.

    Open source URL
  52. [52]
    TelephonyManager

    Android. (n.d.). TelephonyManager. Retrieved December 21, 2016.

    Open source URL
  53. [53]
    Lookout-StealthMango

    Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.

    Open source URL
  54. [54]
    SecureList OpTriangulation 21Jun2023

    Kucherin, G., et al. (2023, June 21). Dissecting TriangleDB, a Triangulation spyware implant. Retrieved April 18, 2024.

    Open source URL
  55. [55]
    TrendMicro-XLoader-FakeSpy

    Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use