{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1532","id":"T1532","name":"Archive Collected Data","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1532","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"926d765ee76cf51a41b9fcea9f3c46edcd33e14a75dd9f600a47731cf64eddb9","description":"Adversaries may compress and/or encrypt data that is collected prior to exfiltration. Compressing data can help to obfuscate its contents and minimize use of network resources. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. \n\n \n\nBoth compression and encryption are done prior to exfiltration, and can be performed using a utility, programming library, or custom algorithm.  ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1532","external_id":"T1532"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0114","name":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Declared or granted permissions of a mobile application.","collection_focus":"Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":{"label":"Inspect the owned Android lab application","language":"shell","source_id":"android_state","content":"adb shell dumpsys package test.example.lab","note":"Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream."},"required_fields":["package","permission","declared","granted"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0123","name":"Application State","page":"telemetry/DC0123/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Application state and lifecycle observations such as foreground/background transitions.","collection_focus":"Instrument the owned app lifecycle and corroborate permitted service snapshots; distinguish app events from inferred gateway activity.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","state_before","state_after","source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0123","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","state_before":"background","state_after":"foreground","source":"own_app_callback"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."}],"detection":{"key":"mobile/T1532","id":"T1532","name":"Archive Collected Data","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1532","technique_page":"techniques/mobile/T1532/","page":"detections/mobile/T1532/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0670","name":"Detection of Archive Collected Data","url":"https://attack.mitre.org/detectionstrategies/DET0670","stix_id":"x-mitre-detection-strategy--b66555c6-297c-4769-affe-8f268b7c3c78","relationship_id":"relationship--a7c55178-6b02-4cae-b4fb-a664ac7d528e","description":"","analytics":[{"id":"AN1767","name":"Analytic 1767","guidance":"For Android, detect Archive Collected Data from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1767","platforms":["Android"],"tuning":[{"field":"TimeWindow","description":"Correlation window between data access, package creation, encryption, and optional network upload"},{"field":"AllowedAppList","description":"Apps legitimately expected to package local data such as backup, cloud sync, file manager, or media editing apps"},{"field":"AllowedPathList","description":"Expected storage paths for legitimate archives, exports, or caches"},{"field":"ForegroundStateRequired","description":"Whether packaging/export behavior should occur only during active user-driven workflows"},{"field":"BurstReadThreshold","description":"Number of files or records read in a short interval before archive creation"},{"field":"ArchiveSizeThreshold","description":"Minimum output size for suspicious packaged blob or archive"},{"field":"EntropyThreshold","description":"Threshold for identifying encrypted or heavily compressed output"},{"field":"UplinkBytesThreshold","description":"Minimum upload size consistent with recent archive creation"}],"log_sources":[{"component_id":"DC0114","component":"Application Permission","name":"android:DevicePolicyManager","channel":"DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review","platforms":["Android"],"analytic_id":"AN1767","source_url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1767","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0114/"},{"component_id":"DC0039","component":"File Creation","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain","platforms":["Android"],"analytic_id":"AN1767","source_url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1767","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0039","component":"File Creation","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence","platforms":["Android"],"analytic_id":"AN1767","source_url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1767","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0021","component":"OS API Execution","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: App invokes ZIP, GZIP, or bulk-buffer packaging routines (ZipOutputStream, DeflaterOutputStream, similar) on previously accessed local data in background state","platforms":["Android"],"analytic_id":"AN1767","source_url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1767","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0021","component":"OS API Execution","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: App applies encryption to newly created archive or staged data blob before network transmission — encrypt-after-archive confirms adversary-controlled packing for exfil","platforms":["Android"],"analytic_id":"AN1767","source_url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1767","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]},{"id":"AN1768","name":"Analytic 1768","guidance":"For iOS, detect Archive Collected Data from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1768","platforms":["iOS"],"tuning":[{"field":"TimeWindow","description":"Correlation window between lifecycle event, local package creation, and upload"},{"field":"AllowedAppList","description":"Managed apps expected to archive, export, or synchronize data"},{"field":"AllowedDestinationList","description":"Approved cloud, enterprise, or sync endpoints for legitimate exports"},{"field":"ForegroundStateRequired","description":"Whether packaging or export should occur only during active user interaction"},{"field":"ArchiveSizeThreshold","description":"Minimum size for suspicious local package or blob"},{"field":"EntropyThreshold","description":"Threshold for identifying encrypted or compressed staged output"},{"field":"UplinkBytesThreshold","description":"Minimum outbound volume consistent with recently created archive"}],"log_sources":[{"component_id":"DC0114","component":"Application Permission","name":"mobile:ApplicationVetting","channel":"Code-signing entitlements and Info.plist privacy usage-description keys","platforms":["iOS"],"analytic_id":"AN1768","source_url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1768","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0114/"},{"component_id":"DC0123","component":"Application State","name":"iOS:MDM","channel":"InstalledApplicationList / ManagedApplicationList","platforms":["iOS"],"analytic_id":"AN1768","source_url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1768","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0123/"},{"component_id":"DC0039","component":"File Creation","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact","platforms":["iOS"],"analytic_id":"AN1768","source_url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1768","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0021","component":"OS API Execution","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: App performs bulk data transformation or packaging-like processing on collected records prior to outbound transfer on supervised device","platforms":["iOS"],"analytic_id":"AN1768","source_url":"https://attack.mitre.org/detectionstrategies/DET0670#AN1768","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]}]}],"telemetry_references":[{"id":"DC0114","name":"Application Permission","tag":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component"},{"id":"DC0123","name":"Application State","tag":"Application State","page":"telemetry/DC0123/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0405","name":"Exodus","url":"https://attack.mitre.org/software/S0405","kind":"malware","description":"[Exodus](https://attack.mitre.org/software/S0405) One encrypts data using XOR prior to exfiltration.(Citation: SWB Exodus March 2019) ","relationship_id":"relationship--10e02179-0434-4d4b-86b4-5d9fbc5d5451","references":[{"source_name":"SWB Exodus March 2019","description":"Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20200314194610/https://securitywithoutborders.org/blog/2019/03/29/exodus.html"}]},{"id":"S0421","name":"GolfSpy","url":"https://attack.mitre.org/software/S0421","kind":"malware","description":"[GolfSpy](https://attack.mitre.org/software/S0421) encrypts data using a simple XOR operation with a pre-configured key prior to exfiltration.(Citation: Trend Micro Bouncing Golf 2019)","relationship_id":"relationship--e5e4567e-05a3-4d79-beab-191efc336473","references":[{"source_name":"Trend Micro Bouncing Golf 2019","description":"E. Xu, G. Guo. (2019, June 28).  Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/"}]},{"id":"S0422","name":"Anubis","url":"https://attack.mitre.org/software/S0422","kind":"malware","description":"[Anubis](https://attack.mitre.org/software/S0422) exfiltrates data encrypted (with RC4) by its ransomware module.(Citation: Cofense Anubis)","relationship_id":"relationship--2621a020-8d4f-4ca4-b874-0be336a8cafd","references":[{"source_name":"Cofense Anubis","description":"M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024.","url":"https://web.archive.org/web/20231222134431/https://cofense.com/blog/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/"}]},{"id":"S0424","name":"Triada","url":"https://attack.mitre.org/software/S0424","kind":"malware","description":"[Triada](https://attack.mitre.org/software/S0424) encrypts data prior to exfiltration.(Citation: Google Triada June 2019) ","relationship_id":"relationship--b5f3b110-fc66-4369-89f3-621c945d655f","references":[{"source_name":"Google Triada June 2019","description":"Lukasz Siewierski. (2019, June 6). PHA Family Highlights: Triada. Retrieved July 16, 2019.","url":"https://security.googleblog.com/2019/06/pha-family-highlights-triada.html"}]},{"id":"S0505","name":"Desert Scorpion","url":"https://attack.mitre.org/software/S0505","kind":"malware","description":"[Desert Scorpion](https://attack.mitre.org/software/S0505) can encrypt exfiltrated data.(Citation: Lookout Desert Scorpion)","relationship_id":"relationship--027a36dc-cd9e-4282-b101-b9a0abbb312f","references":[{"source_name":"Lookout Desert Scorpion","description":"A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.","url":"https://blog.lookout.com/desert-scorpion-google-play"}]},{"id":"S0535","name":"Golden Cup","url":"https://attack.mitre.org/software/S0535","kind":"malware","description":"[Golden Cup](https://attack.mitre.org/software/S0535) has encrypted exfiltrated data using AES in ECB mode.(Citation: Symantec GoldenCup)","relationship_id":"relationship--ca9e5e50-49e9-44cc-a0a4-4ec8633a9506","references":[{"source_name":"Symantec GoldenCup","description":"R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/expert-perspectives/goldencup-new-cyber-threat-targeting-world-cup-fans"}]},{"id":"S0540","name":"Asacub","url":"https://attack.mitre.org/software/S0540","kind":"malware","description":"[Asacub](https://attack.mitre.org/software/S0540) has encrypted C2 communications using Base64-encoded RC4.(Citation: Securelist Asacub)","relationship_id":"relationship--d933bba1-61ab-4fea-b7db-7e2a4f4146e7","references":[{"source_name":"Securelist Asacub","description":"T. Shishkova. (2018, August 28).  The rise of mobile banker Asacub. Retrieved December 14, 2020.","url":"https://securelist.com/the-rise-of-mobile-banker-asacub/87591/"}]},{"id":"S0577","name":"FrozenCell","url":"https://attack.mitre.org/software/S0577","kind":"malware","description":"[FrozenCell](https://attack.mitre.org/software/S0577) has compressed and encrypted data before exfiltration using password protected .7z archives.(Citation: Lookout FrozenCell)","relationship_id":"relationship--d6e4fdc6-c936-4bb9-861f-fafd3b72fcb4","references":[{"source_name":"Lookout FrozenCell","description":"Michael Flossman. (2017, October 5). FrozenCell: Multi-platform surveillance campaign against Palestinians. Retrieved November 11, 2020.","url":"https://blog.lookout.com/frozencell-mobile-threat"}]},{"id":"S1079","name":"BOULDSPY","url":"https://attack.mitre.org/software/S1079","kind":"malware","description":"[BOULDSPY](https://attack.mitre.org/software/S1079) can encrypt its data before exfiltration.(Citation: lookout_bouldspy_0423)","relationship_id":"relationship--11a992e7-83a3-4dc3-b391-fbd79e518943","references":[{"source_name":"lookout_bouldspy_0423","description":"Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.","url":"https://www.lookout.com/blog/iranian-spyware-bouldspy"}]},{"id":"S1082","name":"Sunbird","url":"https://attack.mitre.org/software/S1082","kind":"malware","description":"[Sunbird](https://attack.mitre.org/software/S1082) can exfiltrate collected data as a ZIP file.(Citation: lookout_hornbill_sunbird_0221)","relationship_id":"relationship--ccb6f906-a785-4695-91a5-f1bc210892dc","references":[{"source_name":"lookout_hornbill_sunbird_0221","description":"Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict"}]},{"id":"S1094","name":"BRATA","url":"https://attack.mitre.org/software/S1094","kind":"malware","description":"[BRATA](https://attack.mitre.org/software/S1094) has compressed data with the `zlib` library before exfiltration.(Citation: cleafy_brata_0122)","relationship_id":"relationship--a609b20b-6955-4c59-84d4-a3496d95fba1","references":[{"source_name":"cleafy_brata_0122","description":"Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.","url":"https://www.cleafy.com/cleafy-labs/how-brata-is-monitoring-your-bank-account"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) collects and compresses data to be exfiltrated using SSZipArchive.(Citation: LinkedIn Dmitry LightSpy 2025)(Citation: Threatfabric LightSpy 2024)","relationship_id":"relationship--494ece43-ebba-4519-86be-cd5c4d4dd337","references":[{"source_name":"LinkedIn Dmitry LightSpy 2025","description":"Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.","url":"https://www.linkedin.com/pulse/coordinated-kill-switch-lightspys-ios-destructive-plugin-bestuzhev-zhoye/"},{"source_name":"Threatfabric LightSpy 2024","description":"ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-implant-for-ios"}]},{"id":"S1243","name":"DCHSpy","url":"https://attack.mitre.org/software/S1243","kind":"malware","description":"[DCHSpy](https://attack.mitre.org/software/S1243) has compressed and encrypted collected data with a password from the C2 server.(Citation: Lookout_DCHSpy_July2025) ","relationship_id":"relationship--cea64a5c-1a69-4714-a6b9-2c6764f1fcab","references":[{"source_name":"Lookout_DCHSpy_July2025","description":"Albrecht, J., Islamoglu, A. (2025, July 21). Lookout Discovers Iranian APT MuddyWater Leveraging DCHSpy During Israel-Iran Conflict . Retrieved September 19, 2025.","url":"https://www.lookout.com/threat-intelligence/article/lookout-discovers-iranian-dchsy-surveillanceware"}]}],"actors":[],"mitigations":[],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1532":"/ttp-simulation/techniques/mobile/T1532/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1532","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0123","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","state_before":"background","state_after":"foreground","source":"own_app_callback"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}}]}}