aol.pm

TianySpy

Software · ATTACK:mobile:S1056

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:S1056",
  "title": "TianySpy",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1056",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--fd6d56b2-d84e-4d2a-b37d-d4678d3e08a6",
  "external_id": "S1056",
  "domain": "mobile",
  "created": "2023-01-19T18:05:30.924Z",
  "modified": "2025-04-16T21:22:16.464Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "trendmicro_tianyspy_0122",
      "url": "https://www.trendmicro.com/en_us/research/22/a/tianyspy-malware-uses-smishing-disguised-as-message-from-telco.html"
    }
  ]
}

Explicit source assertions (9)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ae94053-1963-45ba-a3a9-62e508281c8e

trendmicro_tianyspy_0122

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1417.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2caddf52-2bc2-4f75-90bb-0f292952ada6

trendmicro_tianyspy_0122

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38cb6365-40ba-47c6-a5e4-1a9be665f951

trendmicro_tianyspy_0122

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a408dee-07da-4855-b2ff-be512480ccb5

trendmicro_tianyspy_0122

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1422.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--520668a0-2523-4515-8ed9-f8059023632f

trendmicro_tianyspy_0122

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1639

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bc21e5d-b6bb-4c93-9419-19a12061de52

trendmicro_tianyspy_0122

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1623

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a93ee044-bd5d-48f3-972e-0abab780c35c

trendmicro_tianyspy_0122

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eee008fa-a46f-4542-93e3-8fe5f949130f

trendmicro_tianyspy_0122

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9b3a640-fd24-45f0-845b-22a7bf3e0d2b

trendmicro_tianyspy_0122

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.