LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1426: System Information Discovery

Adversaries may attempt to get detailed information about a device’s operating system and hardware, including versions, patches, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not to fully infects the target and/or attempts specific actions.

On Android, much of this information is programmatically accessible to applications through the `android.os.Build` class. [1] iOS is much more restrictive with what information is visible to applications. Typically, applications will only be able to query the device model and which version of iOS it is running.

MobileT1426TechniqueObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

System Information Discovery on mobile devices matters because it helps a malicious app or implant decide what it is running on before taking next actions. On Android, device OS and hardware details are broadly available through android.os.Build; on iOS, applications are more restricted but can typically learn device model and iOS version. For leaders, this is less about the discovery call itself and more about whether the mobile security program can see untrusted apps profiling high-value devices, patch levels, and hardware before follow-on behavior.

Executive priority

Prioritize this as a mobile fleet visibility and readiness issue. The business question is whether security teams can prove which Android and iOS versions, models, and patch states exist across managed devices, and whether risky or unknown applications are allowed to run on sensitive users’ phones. This technique is associated in ATT&CK with multiple mobile malware families and campaigns, so it should inform mobile threat modeling, executive-device protection, incident triage, and audit evidence around mobile inventory and patch governance.

Technical view

Validate coverage across Android and iOS separately. For Android, review whether app analysis, mobile security tooling, or runtime telemetry can identify applications querying android.os.Build or collecting OS, hardware, version, patch, and architecture details, especially when paired with suspicious permissions, recent sideloading, or network transmission of device metadata. For iOS, expect less application-visible detail, but validate monitoring around device model and OS-version collection where telemetry exists. ATT&CK provides no official detection text for T1426, but a related detection strategy object, DET0601, exists; teams should map that strategy to local mobile telemetry before claiming coverage.

Likely telemetry

  • MDM/EMM inventory for device model, OS version, patch level, and platform
  • Mobile threat defense or mobile EDR events, if deployed
  • Application vetting/static analysis results for Android use of android.os.Build and related device-fingerprinting logic
  • Runtime app behavior telemetry where available
  • Network telemetry showing apps transmitting device model, OS version, patch, architecture, or similar metadata

Detection direction

  • Treat standalone system-information collection as low-fidelity because legitimate mobile apps often collect device model and OS version for compatibility, support, and analytics.
  • Increase confidence by correlating discovery with suspicious app provenance, excessive permissions, obfuscation, unusual outbound communication, or other mobile ATT&CK behaviors.
  • Separate Android and iOS logic: Android exposes more system details programmatically, while iOS restricts most app-visible system information to model and OS version.
  • Use ATT&CK relationship context to prioritize tests against mobile malware behaviors that use this technique, but do not infer local exposure without matching telemetry.
  • Account for the revoked Device Type Discovery technique T1419 being consolidated into T1426 when maintaining older detection content or reporting mappings.

Mitigation priorities

  • Maintain accurate mobile asset inventory, including OS version, device model, and patch posture for Android and iOS fleets.
  • Prioritize mobile OS and security patch governance, especially for users and functions where mobile compromise would affect business continuity or sensitive access.
  • Reduce exposure to untrusted applications through managed app distribution, application vetting, and controls on sideloading where organizational policy and platform capability allow.
  • Use mobile security monitoring for high-risk users and devices, with response playbooks for suspicious apps collecting and transmitting device metadata.
  • Align incident response procedures so responders can quickly determine device model, OS version, installed applications, and management status during mobile investigations.
Additional notes and limits

The relationship set is broad: campaigns, groups, and many mobile malware/software entries are linked as using this behavior, including Android and iOS examples. That makes T1426 useful for coverage validation and threat-informed mobile testing, but the behavior is common enough that detection must be correlation-driven. The Android-specific android.os.Build reference is a key technical anchor. iOS visibility should be scoped conservatively because the ATT&CK description states that iOS is more restrictive.

ATT&CK does not provide official detection guidance or tactics for this object in the supplied fields. The relationship data supports that the behavior is used by multiple mobile threats, but it does not establish current activity, customer exposure, or guaranteed detectability. Local conclusions require mobile management coverage, app inventory, device telemetry, and network evidence from the environment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

System Information Discovery

Adversaries may attempt to get detailed information about a device’s operating system and hardware, including versions, patches, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not to fully infects the target and/or attempts specific actions.

On Android, much of this information is programmatically accessible to applications through the `android.os.Build` class. [1] iOS is much more restrictive with what information is visible to applications. Typically, applications will only be able to query the device model and which version of iOS it is running.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
MobileT1419Device Type DiscoveryDevice Type Discovery revoked by this object.
Associated objects

Groups, software, and campaigns

GroupMobile

G0112: Windshift

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.[1][2][3]

MalwareMobile

S0288: KeyRaider

KeyRaider is malware that steals Apple account credentials and other data from jailbroken iOS devices. It also has ransomware functionality. [1]

MalwareMobile

S1083: Chameleon

Chameleon is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, Chameleon has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of Chameleon has expanded its targets to include Android users in the United Kingdom and Italy.[1][2]

Android
MalwareMobile

S9005: DocSwap

DocSwap is an Android malware first identified in 2025, and attributed to Kimsuky. DocSwap’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on DocSwap’s name and Korean-language strings, DocSwap potentially targets mobile device users in South Korea. Several variants of DocSwap exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.[1][2]

Android
MalwareMobile

S0418: ViceLeaker

ViceLeaker is a spyware framework, capable of extensive surveillance and data exfiltration operations, primarily targeting devices belonging to Israeli citizens.[1][2]

Android
MalwareMobile

S0540: Asacub

Asacub is a banking trojan that attempts to steal money from victims’ bank accounts. It attempts to do this by initiating a wire transfer via SMS message from compromised devices.[1]

Android
MalwareMobile

S1056: TianySpy

TianySpy is a mobile malware primarily spread by SMS phishing between September 30 and October 12, 2021. TianySpy is believed to have targeted credentials associated with membership websites of major Japanese telecommunication services.[1]

AndroidiOS
Relationship explorer

All related ATT&CK context

uses · MalwareS0318: XLoader for AndroidMobileuses · MalwareS0288: KeyRaiderMobileuses · MalwareS1083: ChameleonMobileuses · MalwareS0535: Golden CupMobileuses · MalwareS0463: INSOMNIAMobileuses · MalwareS0555: CHEMISTGAMESMobileuses · MalwareS0525: Android/AdDisplay.AshasMobileuses · MalwareS9005: DocSwapMobileuses · MalwareS0418: ViceLeakerMobilerevoked by · TechniqueT1419: Device Type DiscoveryMobileuses · MalwareS0490: XLoader for iOSMobileuses · MalwareS0540: AsacubMobileuses · MalwareS1056: TianySpyMobileuses · MalwareS0507: eSurvMobileuses · MalwareS0422: AnubisMobileuses · MalwareS1077: HornbillMobileuses · MalwareS1094: BRATAMobileuses · MalwareS1062: S.O.V.A.Mobileuses · MalwareS1082: SunbirdMobileuses · MalwareS0506: ViperRATMobileuses · GroupG0112: WindshiftMobileuses · MalwareS0505: Desert ScorpionMobileuses · MalwareS0420: DvmapMobileuses · MalwareS0529: CarbonStealMobile
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
aae030f3c1998ed6...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundleaae030f3c199…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Android-Build

    Android. (n.d.). Build. Retrieved December 21, 2016.

    Open source URL
  2. [2]
    TrendMicro-XLoader-FakeSpy

    Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.

    Open source URL
  3. [3]
    Xiao-KeyRaider

    Claud Xiao. (2015, August 30). KeyRaider: iOS Malware Steals Over 225,000 Apple Accounts to Create Free App Utopia. Retrieved December 12, 2016.

  4. [4]
    cyble_chameleon_0423

    Cyble Research & Intelligence Labs. (2023, April 13). Banking Trojan targeting mobile users in Australia and Poland. Retrieved August 16, 2023.

    Open source URL
  5. [5]
    ThreatFabric_Chameleon_Dec2023

    ThreatFabric. (2023, December 21). Android Banking Trojan Chameleon can now bypass any Biometric Authentication. Retrieved July 7, 2025.

    Open source URL
  6. [6]
    Symantec GoldenCup

    R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.

    Open source URL
  7. [7]
    Google Project Zero Insomnia

    I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.

    Open source URL
  8. [8]
    CYBERWARCON CHEMISTGAMES

    B. Leonard, N. Mehta. (2019, November 21). The Secret Life of Sandworms. Retrieved December 31, 2020.

    Open source URL
  9. [9]
    WeLiveSecurity AdDisplayAshas

    L. Stefanko. (2019, October 24). Tracking down the developer of Android adware affecting millions of users. Retrieved October 29, 2020.

    Open source URL
  10. [10]
    EnkiWhiteHat_KimsukyDOCSWAP_Dec2025

    EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026.

    Open source URL
  11. [11]
    S2W_DocSwap_Mar2025

    Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.

    Open source URL
  12. [12]
    SecureList - ViceLeaker 2019

    GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.

    Open source URL
  13. [13]
    Securelist Asacub

    T. Shishkova. (2018, August 28). The rise of mobile banker Asacub. Retrieved December 14, 2020.

    Open source URL
  14. [14]
    trendmicro_tianyspy_0122

    Trend Micro. (2022, January 25). TianySpy Malware Uses Smishing Disguised as Message From Telco. Retrieved January 11, 2023.

    Open source URL
  15. [15]
    Lookout eSurv

    A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.

    Open source URL
  16. [16]
    Cofense Anubis

    M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024.

    Open source URL
  17. [17]
    lookout_hornbill_sunbird_0221

    Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.

    Open source URL
  18. [18]
    securelist_brata_0819

    Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.

    Open source URL
  19. [19]
    threatfabric_sova_0921

    ThreatFabric. (2021, September 9). S.O.V.A. - A new Android Banking trojan with fowl intentions. Retrieved February 6, 2023.

    Open source URL
  20. [20]
    Lookout ViperRAT

    M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.

    Open source URL
  21. [21]
    BlackBerry Bahamut

    The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.

    Open source URL
  22. [22]
    Lookout Desert Scorpion

    A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.

    Open source URL
  23. [23]
    SecureList DVMap June 2017

    R. Unuchek. (2017, June 8). Dvmap: the first Android malware with code injection. Retrieved December 10, 2019.

    Open source URL
  24. [24]
    Lookout Uyghur Campaign

    A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.

    Open source URL
  25. [25]
    Lookout-Pegasus

    Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.

    Open source URL
  26. [26]
    Kaspersky Riltok June 2019

    Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.

    Open source URL
  27. [27]
    K7Dhanalakshmi_VajraSpy_April2022

    Dhanalakshmi. (2022, April 19). VajraSpy – An Android RAT. Retrieved November 5, 2025.

    Open source URL
  28. [28]
    Kaspersky-WUC

    Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.

    Open source URL
  29. [29]
    Cybereason FakeSpy

    O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.

    Open source URL
  30. [30]
    Zscaler TikTok Spyware

    S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.

    Open source URL
  31. [31]
    ZimperiumGupta_RatMilad_Oct2022

    Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.

    Open source URL
  32. [32]
    Cybereason EventBot

    D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.

    Open source URL
  33. [33]
    Lookout Dark Caracal Jan 2018

    Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.

    Open source URL
  34. [34]
    SecurityIntelligence TrickMo

    P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.

    Open source URL
  35. [35]
    fb_arid_viper

    Flossman, M., Scott, M. (2021, April). Technical Paper // Taking Action Against Arid Viper. Retrieved November 17, 2024.

    Open source URL
  36. [36]
    Palo Alto HenBox

    A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.

    Open source URL
  37. [37]
    lookout_bouldspy_0423

    Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.

    Open source URL
  38. [38]
    lookout_abstractemu_1021

    P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023.

    Open source URL
  39. [39]
    TrendMicro-Anserver2

    Karl Dominguez. (2011, September 27). ANDROIDOS_ANSERVER.A. Retrieved November 30, 2018.

    Open source URL
  40. [40]
    Talos Gustuff Apr 2019

    Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.

    Open source URL
  41. [41]
    Threat Fabric Cerberus

    Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.

    Open source URL
  42. [42]
    CheckPoint Cerberus

    A. Hazum, B. Melnykov, C. Efrati, D. Golubenko, I. Wernik, L. Kuperman, O. Mana. (2020, April 29). First seen in the wild – Malware uses Corporate MDM as attack vector. Retrieved June 26, 2020.

    Open source URL
  43. [43]
    TrendMicro Coronavirus Updates

    T. Bao, J. Lu. (2020, April 14). Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.

    Open source URL
  44. [44]
    welivesec_strongpity

    Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023.

    Open source URL
  45. [45]
    FireEye-RuMMS

    Wu Zhou, Deyu Hu, Jimmy Su, Yong Kang. (2016, April 26). RUMMS: THE LATEST FAMILY OF ANDROID MALWARE ATTACKING USERS IN RUSSIA VIA SMS PHISHING. Retrieved February 6, 2017.

    Open source URL
  46. [46]
    Talos GPlayed

    V. Ventura. (2018, October 11). GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.

    Open source URL
  47. [47]
    Lookout-Monokle

    Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.

    Open source URL
  48. [48]
    SecureList OpTriangulation 01Jun2023

    Kuznetsov, I., et al. (2023, June 1). Operation Triangulation: iOS devices targeted with previously unknown malware. Retrieved April 18, 2024.

    Open source URL
  49. [49]
    Lookout FrozenCell

    Michael Flossman. (2017, October 5). FrozenCell: Multi-platform surveillance campaign against Palestinians. Retrieved November 11, 2020.

    Open source URL
  50. [50]
    welivesecurity_ahrat_0523

    Lukas Stefanko. (2023, May 23). Android app breaking bad: From legitimate screen recording to file exfiltration within a year. Retrieved December 18, 2023.

    Open source URL
  51. [51]
    ZimperiumOrtegaPratapagiri_GodFather_Jun2025

    Ortega, F. Pratapagiri, V. (2025, June 18). Your Mobile App, Their Playground: The Dark Side of Virtualization. Retrieved July 16, 2025.

    Open source URL
  52. [52]
    MerkleScience_Godfather_April2023

    Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025.

    Open source URL
  53. [53]
    Trend Micro Bouncing Golf 2019

    E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.

    Open source URL
  54. [54]
    Threat Fabric Exobot

    Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.

    Open source URL
  55. [55]
    LinkedIn Dmitry LightSpy 2025

    Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.

    Open source URL
  56. [56]
    Threatfabric LightSpy 2024

    ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025.

    Open source URL
  57. [57]
    Threatfabric LightSpy 2023

    ThreatFabric. (2023, October 2). LightSpy mAPT Mobile Payment System Attack. Retrieved January 17, 2025.

    Open source URL
  58. [58]
    MelikovBlackBerry LightSpy 2024

    Melikov, D. (2024, April 11). LightSpy Returns: Renewed Espionage Campaign Targets Southern Asia, Possibly India. Retrieved January 14, 2025.

    Open source URL
  59. [59]
    Wandera-RedDrop

    Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved November 17, 2024.

    Open source URL
  60. [60]
    Bitdefender Mandrake

    R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.

    Open source URL
  61. [61]
    securelist rotexy 2018

    T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.

    Open source URL
  62. [62]
    paloalto_yispecter_1015

    Claud Xiao. (2015, October 4). YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs. Retrieved March 3, 2023.

    Open source URL
  63. [63]
    Android-Build

    Android. (n.d.). Build. Retrieved December 21, 2016.

    Open source URL
  64. [64]
    NIST Mobile Threat CatalogueAPP-12
    Open source URL
  65. [65]
    NIST Mobile Threat CatalogueAPP-12
    Open source URL
  66. [66]
    mitre-attackT1426
    Open source URL
  67. [67]
    mitre-attackT1426
    Open source URL
  68. [68]
    TrendMicro-XLoader-FakeSpy

    Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.

    Open source URL
  69. [69]
    lookout_hornbill_sunbird_0221

    Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.

    Open source URL
  70. [70]
    Lookout Uyghur Campaign

    A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.

    Open source URL
  71. [71]
    Lookout Uyghur Campaign

    A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use