Skip to content

Wi-Fi Discovery

Subtechnique · ATTACK:mobile:T1422.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1422.002",
  "title": "Wi-Fi Discovery",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1422/002",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--be63612f-a48f-44f2-a7a6-1763509fcf80",
  "external_id": "T1422.002",
  "domain": "mobile",
  "created": "2024-02-21T20:44:44.404Z",
  "modified": "2026-05-12T15:12:00.713Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [

  ]
}

Explicit source assertions (14)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15772932-8a5c-4616-9fea-b2bd1ecace4b

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--279b016a-45c8-4961-88fa-48162e56c3fa

lookout_bouldspy_0423

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a5d081f-ba41-4dbe-873b-34b0efee1d92

SecurityIntelligence TrickMo

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47217be3-b80b-459c-acad-01fc0190e8ac

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--850e249d-c0a1-4608-9a60-bcf9c02b741c

Google Project Zero Insomnia

ATTACK:mobile:T1422.002 → subtechnique-of → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8578441b-00d2-4416-a011-380647e6ccdd

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abbbe5ea-f96e-42ad-bfbb-6dbbd66fea55

ESET_VajraSpy_Feb2024

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b23e1e5d-3acc-456a-b63e-31c0bd5fe4a5

TelephonyManager

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca06c79e-8cbd-480a-92a4-cd7cdaaf81c1

Lookout-PegasusAndroid

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3b4f74a-5183-405b-b64b-b79e1c4bd6fc

TrendMicro Coronavirus Updates

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e47ea9b6-8e05-4a54-ac6e-ba621dc3b717

Lookout-Monokle

ATTACK:mobile:S0326 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f458166e-7cf8-42ed-afe3-38cbd30d5607

Wandera-RedDrop

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9456868-aa4c-4aa3-9465-c5a18cbcfd23

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1422.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9b3a640-fd24-45f0-845b-22a7bf3e0d2b

trendmicro_tianyspy_0122

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.