NGate
Software · ATTACK:mobile:S9040
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:S9040",
"title": "NGate",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9040",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--9a3315e6-667d-4b64-b789-5e01653110a5",
"external_id": "S9040",
"domain": "mobile",
"created": "2026-05-13T20:12:36.646Z",
"modified": "2026-10-01T18:29:33.633Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CERTPL_NGate_Nov2025",
"url": "https://cert.pl/en/posts/2025/11/analiza-ngate/"
},
{
"source_name": "ESETStefanko_NGateVariant_Apr2026",
"url": "https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/"
},
{
"source_name": "ESETStefankoOsmani_NGate_Aug2024",
"url": "https://www.welivesecurity.com/en/eset-research/ngate-android-malware-relays-nfc-traffic-to-steal-cash/"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1660
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b04f772-62ef-4103-910f-f8eef8d1031a
CERTPL_NGate_Nov2025 · ESETStefanko_NGateVariant_Apr2026 · ESETStefankoOsmani_NGate_Aug2024ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1476
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4343ef82-8329-43e3-a6a2-116238fe2fcd
CERTPL_NGate_Nov2025 · ESETStefanko_NGateVariant_Apr2026 · ESETStefankoOsmani_NGate_Aug2024ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1646
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94077e81-4098-48fa-a1db-cd0c926a3d24
ESETStefanko_NGateVariant_Apr2026ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1655.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ac05264-8d82-4a84-a4ab-db80638f09f4
ESETStefanko_NGateVariant_Apr2026ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1437
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c15b11c4-f996-4f9a-ae85-410772d6194a
CERTPL_NGate_Nov2025ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1421
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5186dde-b30d-4471-a90e-9c834e35c40d
CERTPL_NGate_Nov2025ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1623
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--caf72a16-c1c9-4871-80c9-6b901b12586d
CERTPL_NGate_Nov2025ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1417.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cee9ebfe-9558-4b07-8a2e-de4c57ea6068
ESETStefankoOsmani_NGate_Aug2024ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1406
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7c99131-c898-451c-811a-80505205d1f1
CERTPL_NGate_Nov2025ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1437.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e93da850-00b9-4ddf-bf9f-b1a4beeb61b5
CERTPL_NGate_Nov2025 · ESETStefanko_NGateVariant_Apr2026ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1644
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7cd4065-0649-4159-b45d-f6b585f45727
CERTPL_NGate_Nov2025 · ESETStefanko_NGateVariant_Apr2026 · ESETStefankoOsmani_NGate_Aug2024