aol.pm

SpyC23

Software · ATTACK:mobile:S1195

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:S1195",
  "title": "SpyC23",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1195",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--95811c0a-abe0-4e7f-a0cc-b0662ced5807",
  "external_id": "S1195",
  "domain": "mobile",
  "created": "2024-03-26T19:12:00.011Z",
  "modified": "2025-02-19T17:09:13.063Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Unit42 VAMP 2017",
      "url": "https://unit42.paloaltonetworks.com/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/"
    },
    {
      "source_name": "Trendmicro GnatSpy 2017",
      "url": "https://www.trendmicro.com/en_us/research/17/l/new-gnatspy-mobile-malware-family-discovered.html"
    },
    {
      "source_name": "welivesecurity_apt-c-23",
      "url": "https://web.archive.org/web/20201123042131/www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/"
    }
  ]
}

Explicit source assertions (22)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06869cb8-7384-4d85-aa0a-78256133c88d

SentinelLabs AridViper 2023 · welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1628.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d58e937-7e0f-4e1e-8c17-bab3906d7c43

welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--122ffed0-5f5a-4588-88a4-16924db24e9e

welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12df8ac7-06a4-4389-8d86-d354c4536e28

Cyware APT-C-23 2020 · SentinelLabs AridViper 2023 · sophos_android_apt_spyware · welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20e8cf98-b5c1-4ad8-bdba-a9bad0344bef

welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--243bafe0-206c-4a17-94a6-4ff0492ebc7a

sophos_android_apt_spyware · threatpost AndroidSpyware 2020 · welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1633

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55f1c604-f3e1-4eef-8313-d136425be83d

SentinelLabs AridViper 2023

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a55b7a2-52ab-4cf8-abc1-8ec4e42102cb

SentinelLabs AridViper 2023

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b4128cc-ae1b-4a1b-bc51-d4fdc507bc27

checkpoint_hamas_android_malware · SentinelLabs AridViper 2023 · welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60da837d-a635-4533-b96a-db2689cc4771

welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a87a107-e607-460b-a08c-cc693b15268c

sophos_android_apt_spyware · threatpost AndroidSpyware 2020 · welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d8ffc4a-6496-423e-a44d-d5a973ee1acf

Cyware APT-C-23 2020 · SentinelLabs AridViper 2023 · sophos_android_apt_spyware · threatpost AndroidSpyware 2020 · welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76336d14-0dcb-4fc4-8423-9996dca9a9f2

welivesecurity_apt-c-23

ATTACK:mobile:G1028 → uses → ATTACK:mobile:S1195

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81d4d8cf-3785-4847-9c9e-5ea27580f93a

checkpoint_hamas_android_malware · fb_arid_viper · sophos_android_apt_spyware · welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1629.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9557dc5c-272d-46ba-bd39-0ac2be35df19

welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99fabe9d-0202-4d12-aa7c-34e2a15b2648

welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a153f40b-ba34-4419-9189-d61b5cd29802

threatpost AndroidSpyware 2020

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa490344-f7e0-4e5a-abb1-af9209f15ce4

welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aad084c4-97ea-4f4b-8d96-d18f57534e01

sophos_android_apt_spyware · welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c773998e-a140-4498-827a-573df96e4331

checkpoint_hamas_android_malware · Cyware APT-C-23 2020 · SentinelLabs AridViper 2023 · sophos_android_apt_spyware · threatpost AndroidSpyware 2020 · welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd440baa-9989-486e-b34b-d9469ffc79a5

sophos_android_apt_spyware · welivesecurity_apt-c-23

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e524f30e-11b5-4bd9-83f1-9694e6d8f030

sophos_android_apt_spyware · threatpost AndroidSpyware 2020 · welivesecurity_apt-c-23

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.