RCSAndroid
Software · ATTACK:mobile:S0295
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:S0295",
"title": "RCSAndroid",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0295",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--363bc05d-13cb-4e98-a5b7-e250f2bbdc2b",
"external_id": "S0295",
"domain": "mobile",
"created": "2017-10-25T14:48:38.274Z",
"modified": "2025-04-25T14:40:22.773Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "RCSAndroid"
},
{
"source_name": "TrendMicro-RCSAndroid",
"url": "http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-rcsandroid-spying-tool-listens-to-calls-roots-devices-to-get-in/"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S0295 → uses → ATTACK:mobile:T1429
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14143e21-51bf-4fa7-a949-d22a8271f590
TrendMicro-RCSAndroidATTACK:mobile:S0295 → uses → ATTACK:mobile:T1636.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2065382f-45ae-4b9a-a77c-027ecd6c1735
TrendMicro-RCSAndroidATTACK:mobile:S0295 → uses → ATTACK:mobile:T1409
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4088b31b-d542-4935-84b4-82b592159591
TrendMicro-RCSAndroidATTACK:mobile:S0295 → uses → ATTACK:mobile:T1644
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8cb42e3d-69f4-4b0d-98c9-0bb7560947c1
TrendMicro-RCSAndroidATTACK:mobile:S0295 → uses → ATTACK:mobile:T1407
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d027310-93a0-4046-b7ad-d1f461f30838
TrendMicro-RCSAndroidATTACK:mobile:S0295 → uses → ATTACK:mobile:T1414
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e3921a8-a9e1-48c4-9b61-ff190c104f63
TrendMicro-RCSAndroidATTACK:mobile:S0295 → uses → ATTACK:mobile:T1533
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a76d731b-484c-442a-b1a3-255d8398aefd
TrendMicro-RCSAndroidATTACK:mobile:S0295 → uses → ATTACK:mobile:T1512
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf26d49c-1d1b-4861-9d6e-959f4f15b73a
TrendMicro-RCSAndroidATTACK:mobile:S0295 → uses → ATTACK:mobile:T1430
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da4296d7-5fdb-45b6-9791-b023d634c08d
TrendMicro-RCSAndroid