Skip to content

Obfuscated Files or Information

Technique · ATTACK:mobile:T1406

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1406",
  "title": "Obfuscated Files or Information",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1406",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a",
  "external_id": "T1406",
  "domain": "mobile",
  "created": "2017-10-25T14:48:32.328Z",
  "modified": "2026-05-12T15:12:00.717Z",
  "version": "3.1",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion"
  ],
  "source_references": [
    {
      "source_name": "Microsoft MalLockerB",
      "url": "https://www.microsoft.com/security/blog/2020/10/08/sophisticated-new-android-malware-marks-the-latest-evolution-of-mobile-ransomware/"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-21.html",
      "external_id": "APP-21"
    }
  ]
}

Explicit source assertions (51)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--033e6e76-2274-4c1f-9a88-a3206836867e

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04d9e597-f25b-40cf-bdb6-d552255acc78

ThreatFabric_Crocodilus_June2025

ATTACK:mobile:S0545 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07dd3318-2965-4085-be64-a8e956c7b8da

WhiteOps TERRACOTTA

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09d08f16-9e4d-4279-9a8c-bdda7afdb37d

lookout_abstractemu_1021

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b1aae4b-4dcd-41b6-a708-1441e5a24070

Talos Gustuff Apr 2019

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12098dee-27b3-4d0b-a15a-6b5955ba8879

Lookout-Monokle

ATTACK:mobile:S0524 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23cac1d7-27ca-4c78-bfa0-2d6023d21798

Microsoft MalLockerB

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24a7379e-a994-411b-b17c-add6c6c6fc07

Lookout Uyghur Campaign

ATTACK:mobile:S0432 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29357289-362c-447c-b387-9a38b50d7296

Google Bread · Check Point-Joker

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e59d381-eac6-41c6-a5e6-f9617c10259e

Volexity Insomnia

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32958f57-ad9b-4fe1-abf3-6f92df895014

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--386b0a9f-9951-4717-8bce-30c8fbe05050

Threat Fabric Cerberus

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38cb6365-40ba-47c6-a5e4-1a9be665f951

trendmicro_tianyspy_0122

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a7d4872-2bfb-4df3-ad53-91c8229b9b41

welivesec_strongpity

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c4ea7a5-251c-4d10-a724-f4a247f44637

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42f8d024-64a7-4bbf-8c05-2b0c7e667396

Securelist Asacub

ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57e441f8-6799-4d1b-8e2a-13d8ac1c8e78

proofpoint_flubot_0421

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--597579b4-7e2f-4843-8cd3-f9143eca34f2

welivesecurity_ahrat_0523

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b37d94a-64a3-432a-b340-1c9a4f553d02

Palo Alto HenBox

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fb59cf9-9af5-4dd5-9878-dda2ba228ae5

cleafy_brata_0122 · mcafee_brata_0421

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60db521a-ae2d-4a9a-8c6d-47a5528f1ecb

Trend Micro Bouncing Golf 2019

ATTACK:mobile:T1406.002 → subtechnique-of → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6661823b-4fdd-4879-ad5d-64c9a4b12519

ATTACK:mobile:S0555 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--694857ba-92e8-462e-8900-a9f6fdcf495d

CYBERWARCON CHEMISTGAMES

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76336d14-0dcb-4fc4-8423-9996dca9a9f2

welivesecurity_apt-c-23

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7696b512-ba2f-4310-86e1-7c528529fc5e

Cybereason FakeSpy

ATTACK:mobile:S0293 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78cc0d6d-6347-45a4-a18c-ca76150aa7a9

Lookout-BrainTest

ATTACK:mobile:S1054 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e6b9c1e-5e28-4519-95c3-6b4a836661de

cyble_drinik_1022

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f2ff9c5-249d-4a9a-bdc6-0cef887eaefc

Bitdefender Mandrake

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91de92af-fe1d-469e-8c36-1a9f4b621a27

ATTACK:mobile:S0494 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97417113-1840-4e00-98d3-bb222e1a1f60

Google Security Zen

ATTACK:mobile:S0525 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a042d55c-b31e-41c1-9cd0-66070ec9a11d

WeLiveSecurity AdDisplayAshas

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a28a53e9-7a42-4f81-bced-0efbc3128cbd

FortiGuard-FlexiSpy

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a299e0a6-cada-4629-a6c6-ed73dc4422aa

ATTACK:mobile:S0318 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5b72279-f99e-4f03-8669-04322b40ee6b

TrendMicro-XLoader

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6bb6c55-3b33-4cd4-981b-055551edc4c2

nccgroup_sharkbot_0322

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8dd6ed7-910d-4bae-a2a8-19f3f32c915c

securelist rotexy 2018

ATTACK:mobile:S0312 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3bb33bf-9034-4d5c-8ea0-31d3bbd12b6b

PaloAlto-WireLurker

ATTACK:mobile:S0286 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b67f04d9-1cbd-49b4-9ec3-a33a41ac42ab

TrendMicro-Obad

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb006be2-7d2c-4bb3-ab48-7c95e0ab8106

Sophos Red Alert 2.0

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bed52256-e5d2-4f15-8c4c-27f709e10c6c

Cybereason EventBot

ATTACK:mobile:S0323 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bee6407a-1f05-4f91-b6e7-a8f8b58fa421

CheckPoint-Charger

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca486783-9413-4f39-8d2f-3adcb3e79127

Lookout Uyghur Campaign

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc4ae06f-0258-4fe9-b63a-334d283e766d

BlackBerry Bahamut

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7aa436a-e66d-4217-be66-4414703dec07

Lookout Uyghur Campaign

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7bd4131-a95e-4f6a-a9ce-113079f1dbec

ZimperiumOrtegaPratapagiri_GodFather_Jun2025

ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7c99131-c898-451c-811a-80505205d1f1

CERTPL_NGate_Nov2025

ATTACK:mobile:S0420 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d886f368-a38b-4cb3-906f-9b284f58b369

SecureList DVMap June 2017

ATTACK:mobile:T1406.001 → subtechnique-of → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f012feab-5612-429f-81bd-ff75d6ffd04e

ATTACK:mobile:S1214 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f524f2d9-cdf7-403b-af0f-96c1c60b32a8

McAfee MoqHao 2019

ATTACK:mobile:S0423 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f88cbb0c-ca34-4a87-82fa-e0e567ee8d57

ThreatFabric Ginp

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd5b3d4b-5d56-4d66-8b57-f858bc139901

SecurityIntelligence TrickMo

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.