Skip to content

Stored Application Data

Technique · ATTACK:mobile:T1409

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1409",
  "title": "Stored Application Data",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1409",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--702055ac-4e54-4ae9-9527-e23a38e0b160",
  "external_id": "T1409",
  "domain": "mobile",
  "created": "2017-10-25T14:48:15.402Z",
  "modified": "2026-05-12T15:12:00.641Z",
  "version": "3.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "SWB Exodus March 2019",
      "url": "https://web.archive.org/web/20200314194610/https://securitywithoutborders.org/blog/2019/03/29/exodus.html"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-0.html",
      "external_id": "AUT-0"
    }
  ]
}

Explicit source assertions (33)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04530307-22d8-4a06-9056-55eea225fabb

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--088c74f5-4b43-48aa-a2be-275f0c02ffc8

lookout_bouldspy_0423

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--142532a6-bf7c-4b25-be23-16f01160f3c5

Cybereason FakeSpy

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ed5b4fa-b871-4efa-87ee-1c91dcaa421e

SWB Exodus March 2019

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27b8153c-130e-44a7-84a9-840f4c23e2ea

Bitdefender Mandrake

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32be51e2-f74d-441f-aa0d-952697a76494

FortiGuard-FlexiSpy

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3364dd33-c012-4aaf-852b-86e63bd724ac

cleafy_sova_1122 · threatfabric_sova_0921

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ebcd3d8-dd8e-4cc9-8087-ce9e93df6f56

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f973c3c-45f8-432a-9859-e8749f2e7418

Lookout-PegasusAndroid

ATTACK:mobile:S0295 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4088b31b-d542-4935-84b4-82b592159591

TrendMicro-RCSAndroid

ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--501c3f2a-1ae0-4832-9730-3fdf5f31df5c

Europol FluBot Jun2022

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56816b86-3c80-429b-8360-7b4e77538c97

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023

ATTACK:mobile:S1128 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6859be95-c11a-4085-b8d3-c4ea4e2add44

Meta Adversarial Threat Report 2022

ATTACK:mobile:S1093 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--812490b8-2160-47e9-9e1e-c1749b7ee86d

Zimperium FlyTrap · Trend Micro FlyTrap

ATTACK:mobile:S0311 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c50e9e7-e13c-4814-98d0-088d73b10005

paloalto_yispecter_1015

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f4c7030-f3e2-4c7d-b5b1-dc6815055c68

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0329 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92129d5b-7822-4e84-8a69-f96b598fba9e

Lookout-StealthMango

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--972f0703-f4d7-42d2-8ca2-bec175dac0bf

Lookout Desert Scorpion

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9819974c-f093-482b-8b2b-93a05ab7382e

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1103 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98360714-5239-442f-9619-d562b4b7ce76

checkpoint_flixonline_0421

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a290a8ca-e650-456c-b33e-03343fe5ea4e

Lookout-Pegasus

ATTACK:mobile:S1243 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad1cd55e-10a7-4895-bc76-160e2de319cf

Lookout_DCHSpy_July2025

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8879a8a-84ff-4625-b487-7922d8a1b6a6

SecureList OpTriangulation 23Oct2023

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba116807-ef1c-4621-84c8-9921fa7b735e

Bleeipng Computer Escobar

ATTACK:mobile:S0577 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bce64ec2-43d5-4501-a0aa-0abe65551a19

Lookout FrozenCell

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd351b17-e995-4528-bbea-e1138c51476a

PaloAlto-SpyDealer

ATTACK:mobile:G0034 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0f03d23-03d6-4457-b783-792d1b8f2994

mandiant_apt44_unearthing_sandworm

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1d853f3-660d-4c65-a977-3823d4d5ecd3

K7Dhanalakshmi_VajraSpy_April2022 · ESET_VajraSpy_Feb2024

ATTACK:mobile:S0327 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c374c9ce-ff30-4daa-bdec-8015a507746a

Kaspersky-Skygofree

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4154247-90ce-43b9-8c17-5c28f67617f5

Lookout Uyghur Campaign

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5928f73-c4ba-4eb1-bf8a-e75ff6806a4a

Lookout Uyghur Campaign

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e269e6a2-a709-4aa1-a260-f3f0d0284056

Lookout Uyghur Campaign

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcc42341-ec3a-4e24-a374-46bed72d061f

SecureList BusyGasper

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.