Skip to content

Download New Code at Runtime

Technique · ATTACK:mobile:T1407

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1407",
  "title": "Download New Code at Runtime",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1407",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--6c49d50f-494d-4150-b774-a655022d20a6",
  "external_id": "T1407",
  "domain": "mobile",
  "created": "2017-10-25T14:48:14.460Z",
  "modified": "2026-05-12T15:12:00.640Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion"
  ],
  "source_references": [
    {
      "source_name": "FireEye-JSPatch",
      "url": "https://www.fireeye.com/blog/threat-research/2016/01/hot_or_not_the_bene.html"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-20.html",
      "external_id": "APP-20"
    }
  ]
}

Explicit source assertions (41)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--006e9850-9213-40c8-bfe0-5dac4383c9c2

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S0424 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00dc2b34-1b74-4dae-b6e4-b676528d6341

Google Triada June 2019

ATTACK:mobile:S0420 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04eeed4b-e0fc-4fff-8c61-4c175f26a0fe

SecureList DVMap June 2017

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--078653a6-3613-4923-ae5a-1bccb8552e67

Lookout ViperRAT

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--085f8397-0233-42d7-855e-3dbd709f2eca

nccgroup_sharkbot_0322

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b5bfa77-51b4-41b4-ae03-88b585d143c1

Lookout Desert Scorpion

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11113fa5-150e-4574-89fc-5db66479e268

cleafy_brata_0122 · mcafee_brata_0421

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13e69c40-1511-4fac-b4c3-d31fc4b6c579

lookout_bouldspy_0423

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14474366-938a-4359-bf24-e2c718adfaf5

Cybereason EventBot

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f027bab-76d9-4f5f-a73e-ea733a1ab223

Symantec GoldenCup

ATTACK:mobile:S0432 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f8b1ee1-e44b-4a37-a407-5cbceba35d87

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--346b7e4a-dbd1-486b-ba26-55ae2ac613d0

Sophos Red Alert 2.0

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37123a8d-5c03-459c-bd0b-c17e2ee75a10

Threat Fabric Cerberus

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ebdc17d-401e-4f6a-af51-2dc57437b817

Android 10 Execute

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b16e681-9542-4f32-b23a-f1b0caf44b6a

Lookout Uyghur Campaign

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d4dfc26-3ab7-4798-abf2-be8dc278fdfa

ATTACK:mobile:S0577 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54dac52d-5279-407f-b7b4-5484ae90b98c

Lookout FrozenCell

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59bd2521-3df2-49f1-afb7-ee78995740dc

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S0494 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--634071ce-d386-4143-8e6e-b88bc077de6d

Google Security Zen

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65acbbe2-48e1-4fba-a781-39fb040a711d

SWB Exodus March 2019

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b41d649-bcd0-4427-baa1-15a145bace6e

PaloAlto-SpyDealer

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f9f892e-56ec-480b-aa40-337f20f2bb9c

Lookout Uyghur Campaign

ATTACK:mobile:S0293 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--706c698c-aa8d-4fac-a6c1-2e047c3f965c

Lookout-BrainTest

ATTACK:mobile:S0325 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81fb62ac-ba04-48d2-8817-52d0652f61a0

CheckPoint-Judy

ATTACK:mobile:S0295 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d027310-93a0-4046-b7ad-d1f461f30838

TrendMicro-RCSAndroid

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e458d77-c856-4b02-82a7-50947b232dc3

SecureList BusyGasper

ATTACK:mobile:S0327 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3f36e9e-e2f4-4745-a9a3-0d1231db116d

Kaspersky-Skygofree

ATTACK:mobile:S0311 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8565c17-7054-4d3f-bca5-6e17dc931491

paloalto_yispecter_1015

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac415e32-e204-4382-b500-2370cec7a608

cyble_chameleon_0423

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adc9957c-fa57-4e81-9231-b60f01b69859

Lookout Uyghur Campaign

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1e5bd2f-01e4-402d-a9b6-255110510a83

Lookout Uyghur Campaign

ATTACK:mobile:S0555 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be27a303-5748-4b72-ba69-a328e2f6cc08

CYBERWARCON CHEMISTGAMES

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbf17fea-141e-44b8-831c-b3cc41066420

Trend Micro Anubis

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cce82a76-5390-473d-9e7c-9450d1509d1d

Bitdefender Mandrake

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cde60121-3d7c-47c8-abeb-582854425599

ATTACK:mobile:S0287 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d54bdaff-8eb8-4a02-9f64-bc33c892e9d1

Xiao-ZergHelper

ATTACK:mobile:S0545 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0f58ab7-b246-4c41-9afc-89b582590809

WhiteOps TERRACOTTA

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e457921c-4a0b-4d6e-92e7-553929ddf943

lookout_abstractemu_1021

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e99fd1c9-441f-41bc-83a1-e7bed8f2d7fb

Palo Alto HenBox

ATTACK:mobile:S0507 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcdc2f1f-9787-4faa-86bf-2ed73f15a576

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffc82546-f4da-4f47-88ec-b215edb1d695

BlackBerry Bahamut

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.