aol.pm

C0033

Campaign · ATTACK:mobile:C0033

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:C0033",
  "title": "C0033",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0033",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--a82bc5ad-5f95-4c6a-9f25-aaf6f476a3c4",
  "external_id": "C0033",
  "domain": "mobile",
  "created": "2024-03-28T18:00:04.123Z",
  "modified": "2026-07-31T20:48:20.147Z",
  "version": "1.0",
  "aliases": [
    "C0033"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "securelist_strongpity",
      "url": "https://securelist.com/on-the-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users/76147/"
    },
    {
      "source_name": "welivesec_strongpity",
      "url": "https://www.welivesecurity.com/2023/01/10/strongpity-espionage-campaign-targeting-android-users/"
    }
  ]
}

Explicit source assertions (22)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--068c3d23-8aa2-48e9-acb3-c72651c94f0b

trendmicro_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1521.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--076d8c54-e6f6-47c4-9f61-52964d4f1c35

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1421

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0891421a-8476-4d37-b274-645b90f139c7

trendmicro_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c49a6e0-9837-424d-877b-4e232f5fe250

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1456

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--114f4334-16f4-402e-981a-902b2c9be6fb

trendmicro_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--158f71f5-e24a-4c5b-95d9-6f7e03257052

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16d969ca-59ae-4c87-888f-fa231ad863d1

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1420

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3020bb16-fb1f-46f9-9e1c-3b3317af6b96

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a7d4872-2bfb-4df3-ad53-91c8229b9b41

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ed97a0d-2fcf-4c53-8aaa-21e174b28309

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50e3b570-2e9a-409b-973a-3ce91b9579d4

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60439118-3ceb-490b-9df5-e35e7fca9009

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:S0491

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e6c72b6-ed92-4574-af75-c5115836e3ec

Talos Promethium June 2020 · Bitdefender StrongPity June 2020

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--717feaf1-493b-4a3e-b886-40652f41168d

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--797e82a0-0132-4adc-8885-c9e9d88386dd

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1629.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--935d2296-2a9d-42dd-af8c-2d8873dd7e8f

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b01f11f2-064b-4210-a8f2-f5c6360f64e4

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbd619c8-bd9a-4107-a60f-7a3a9f953735

trendmicro_strongpity · welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1532

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be526f3a-480f-4ede-b772-2b29b8a3ca2b

welivesec_strongpity

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1fc106e-1671-4103-b767-47b52c9b0742

welivesec_strongpity

ATTACK:mobile:C0033 → attributed-to → ATTACK:mobile:G0056

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f372697e-b661-4995-9920-4ec0a9060ebb

Talos Promethium June 2020 · Bitdefender StrongPity June 2020

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f781fd2c-209f-43f1-b55a-fb175187415f

welivesec_strongpity

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.