FluBot
Software · ATTACK:mobile:S1067
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:S1067",
"title": "FluBot",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1067",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--f5ff006c-702f-4ded-8e60-ca6c540d91bc",
"external_id": "S1067",
"domain": "mobile",
"created": "2023-02-28T20:25:59.034Z",
"modified": "2025-03-27T22:35:44.281Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "proofpoint_flubot_0421",
"url": "https://www.proofpoint.com/us/blog/threat-insight/flubot-android-malware-spreading-rapidly-through-europe-may-hit-us-soon"
},
{
"source_name": "Europol FluBot Jun2022",
"url": "https://www.europol.europa.eu/media-press/newsroom/news/takedown-of-sms-based-flubot-spyware-infecting-android-phones"
},
{
"source_name": "bitdefender_flubot_0524",
"url": "https://www.bitdefender.com/blog/labs/new-flubot-campaign-sweeps-through-europe-targeting-android-and-ios-users-alike/"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1582
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f116d99-9ce4-4790-aeda-ad9199d8bf7b
proofpoint_flubot_0421 · bitdefender_flubot_0524ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1637.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f32e107-aef9-42f8-84d1-4c4fcd863b7f
proofpoint_flubot_0421ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1636.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a5f4f05-bd60-4571-bcce-f3b764a5b5a0
proofpoint_flubot_0421 · Europol FluBot Jun2022ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1629.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b7e117b-0c82-49d0-bee6-119158b3355b
proofpoint_flubot_0421 · Europol FluBot Jun2022ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1409
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--501c3f2a-1ae0-4832-9730-3fdf5f31df5c
Europol FluBot Jun2022ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1406
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57e441f8-6799-4d1b-8e2a-13d8ac1c8e78
proofpoint_flubot_0421ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67aa692c-24e4-483e-996e-02ce1e861ec8
proofpoint_flubot_0421ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1660
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91fa8232-f987-415b-8cb4-1ff3302a6c63
Europol FluBot Jun2022ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1604
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93b6bf37-5614-4317-8ed7-42f098152c40
proofpoint_flubot_0421ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1437.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98a4a746-e7bf-494c-9ee3-584403d76d3e
proofpoint_flubot_0421ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1628.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0fe69e0-d08f-488d-b1cf-3f0dbb28accc
proofpoint_flubot_0421ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1453
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c30d659c-dd17-4fb0-9b88-2f29427f273b
SahinSRLabs_FluBot_Dec2021ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1636.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1e11627-23e4-40f3-bcbc-2b832b0bbaa3
proofpoint_flubot_0421ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1646
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e34c8c23-be8f-4da9-b051-5246e5f16ba8
proofpoint_flubot_0421ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1521.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e889782a-f66b-448e-a466-e55b1bce7b64
proofpoint_flubot_0421ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1517
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eda3c5c4-d062-48d3-a78e-051f0c9d62f6
proofpoint_flubot_0421ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1629.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee095f20-eef5-4dcc-a537-70b387592c2c
bitdefender_flubot_0524