Gustuff
Software · ATTACK:mobile:S0406
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:S0406",
"title": "Gustuff",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0406",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--ff8e0c38-be47-410f-a2d3-a3d24a87c617",
"external_id": "S0406",
"domain": "mobile",
"created": "2019-09-03T20:08:00.241Z",
"modified": "2026-09-02T18:52:35.430Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Talos Gustuff Apr 2019",
"url": "https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1406
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b1aae4b-4dcd-41b6-a708-1441e5a24070
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1533
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--295fab07-9f02-4504-9ae4-1a60c2e8c224
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1418.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38962b26-7cbe-4761-8b4f-50a022167c4d
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1636.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cc8a16f-562a-42c7-b5d9-10e1088af89c
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1406.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67c2b73d-cd51-4894-a7bd-fdd5d14b33a2
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1636.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d2c7743-fc75-4524-b217-13867ca1dd10
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1417.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cae8c80-c603-4352-a704-f3a2f4aa4a56
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1422
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95bf4e8b-f388-48a0-b236-c2077252e71e
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1644
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96569099-db95-4f3c-8ded-6d9cf023e55e
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1437.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5dac41f-4a16-44ea-b279-b84c927ce62d
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1426
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a87fa426-3968-4d3b-8f8d-8e3c3a9c32f5
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa1deed1-800c-470b-ac88-eb8013c11ec0
Group IB Gustuff Mar 2019 · Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1628.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0d0541d-caeb-43c0-906c-2e1e2ec25f69
Group IB Gustuff Mar 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1629.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6feb018-65e3-46ff-b872-e4385b6f3b34
ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1516
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cacc0b72-9d73-4381-90e9-545ba908722c
Talos Gustuff Apr 2019ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1476
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfda3abb-4372-4dbf-ace3-b8d5a0a6ad60
Talos Gustuff Apr 2019