Skip to content

System Information Discovery

Technique · ATTACK:mobile:T1426

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1426",
  "title": "System Information Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1426",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e2ea7f6b-8d4f-49c3-819d-660530d12b77",
  "external_id": "T1426",
  "domain": "mobile",
  "created": "2017-10-25T14:48:19.265Z",
  "modified": "2026-05-12T15:12:00.722Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Android-Build",
      "url": "https://developer.android.com/reference/android/os/Build"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-12.html",
      "external_id": "APP-12"
    }
  ]
}

Explicit source assertions (58)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0318 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--020f79c6-d5f8-49eb-beee-e716e1fa4e80

TrendMicro-XLoader-FakeSpy

ATTACK:mobile:S0288 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05563777-5771-4bd6-a1af-3e244cf42372

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06e2e07f-7835-4ef8-bcc0-bb5e2886839d

cyble_chameleon_0423 · ThreatFabric_Chameleon_Dec2023

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07036963-6f5e-4eb5-9b20-3f81dd582c85

Symantec GoldenCup

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0993769f-63fb-4720-bbcf-e6f37f71515e

Google Project Zero Insomnia

ATTACK:mobile:S0555 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b693e45-cc20-45a9-846f-2f5f4d3a3253

CYBERWARCON CHEMISTGAMES

ATTACK:mobile:S0525 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c180c0e-c789-4176-b568-789ada9487bb

WeLiveSecurity AdDisplayAshas

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c7d2614-c1a6-4193-8053-e5ca8a15437f

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--271a311f-71bc-4558-a314-0edfbec44b64

SecureList - ViceLeaker 2019

ATTACK:mobile:S0490 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f392718-87c4-483b-b89f-4f0cc056d251

TrendMicro-XLoader-FakeSpy

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--496976ef-4a0c-4782-95e7-231bd44df162

Securelist Asacub

ATTACK:mobile:S1056 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a408dee-07da-4855-b2ff-be512480ccb5

trendmicro_tianyspy_0122

ATTACK:mobile:S0507 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4df6a22e-489f-400c-b953-cc53bfb708a3

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50ad2a8c-ed45-4376-be31-8bafa26ba794

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54bfecbc-4d1d-4bca-bb9c-652d09b29515

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--583720d0-8b15-4662-822e-bb40bc1df940

securelist_brata_0819

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60ad088f-3133-4b0c-a441-e1e06fff1765

threatfabric_sova_0921

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a813057-5fe0-46b5-89a3-c804d223568c

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c859d6b-28b1-409d-90ea-d4eba64edf82

Lookout ViperRAT

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ca3e3d9-2db9-4bed-98a0-417ff1e6a78e

BlackBerry Bahamut

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6de29595-e63e-4d7e-992f-b4622b7b8e23

Lookout Desert Scorpion

ATTACK:mobile:S0420 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70ec9e67-b755-41ee-a1db-71d250a90b4e

SecureList DVMap June 2017

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--760faa7b-06cb-48b7-9103-1c52f2ca408f

Lookout Uyghur Campaign

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7af7d094-3a49-4e5e-99d0-385c79f95f06

Lookout-Pegasus

ATTACK:mobile:S0403 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b8c3ae2-7e52-4f1d-ad30-788b367a7531

Kaspersky Riltok June 2019

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c8dadca-5cc0-40d0-a946-afa99c99cbaf

K7Dhanalakshmi_VajraSpy_April2022

ATTACK:mobile:S0304 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83991b5c-59b9-4fe5-9ef2-39c6ddc8b835

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--873b98de-d7cf-471b-9aa2-229eb03c9165

Cybereason FakeSpy

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c8ce536-d9b5-4dfc-93f1-84c4f222b49e

Zscaler TikTok Spyware

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--904221c2-2486-4e0b-905f-5327ee299097

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92c9106d-a71b-4a4f-a9d4-ef692a0294eb

Cybereason EventBot

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9366529d-fba9-4ef6-b4ee-b6b41aa3b18c

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--950e1476-83ca-4e81-b542-c91a19b206d7

SecurityIntelligence TrickMo

ATTACK:mobile:S1126 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99011840-f920-44d1-82f9-a6ff0d4f8c07

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c853c22-7607-4cbd-b114-08aaa4625c35

Palo Alto HenBox

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a25a0454-d6da-4448-a3c5-33648ee6675a

lookout_bouldspy_0423

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a46c3b05-07d5-461c-b1b1-4a81912b79f8

lookout_abstractemu_1021

ATTACK:mobile:S0310 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a82d3cfb-7ef2-4e39-a6e1-3097d7b106f7

TrendMicro-Anserver2

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a87fa426-3968-4d3b-8f8d-8e3c3a9c32f5

Talos Gustuff Apr 2019

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad0c873b-9e45-44e0-adaf-529921ee7a77

Threat Fabric Cerberus · CheckPoint Cerberus

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b018fe06-740b-4864-b30a-f047598506b3

TrendMicro Coronavirus Updates

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b01f11f2-064b-4210-a8f2-f5c6360f64e4

welivesec_strongpity

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9b9ce86-89f6-41ea-8ba1-9520985acb49

Lookout Uyghur Campaign

ATTACK:mobile:S0313 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb3be217-08e2-4bb0-9f1a-d8e538010451

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbe1af69-7303-4205-82d8-5b03c43e39c1

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be256f8a-8bae-4a00-8682-22797ba7e0ce

Lookout-Monokle

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf02dea9-17cb-41f8-b362-c3081da81199

SecureList OpTriangulation 01Jun2023

ATTACK:mobile:S0577 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c264d954-8b5f-4be1-acf0-6387b7f04fae

Lookout FrozenCell

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c32cbb0c-b5d7-44ad-94aa-43e2fbade91d

welivesecurity_ahrat_0523

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6d7f454-8dc1-4928-a668-f71aba491e45

MerkleScience_Godfather_April2023 · ZimperiumOrtegaPratapagiri_GodFather_Jun2025

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ccfffa97-17fd-4826-9a16-c9d8174fb8ac

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da424f3f-8a93-4a66-858c-b33f587108e6

Threat Fabric Exobot

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4451543-136b-4fe2-a8e2-d005db705aa2

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S0326 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9cbc901-38cb-4895-9dfb-7a4fe10ba6d7

Wandera-RedDrop

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eceeb39e-887c-4a9b-a93b-a6fd768e455a

Bitdefender Mandrake

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee9c1a8c-5f84-4571-8518-300a6412df0f

securelist rotexy 2018

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9de9819-b131-459e-948b-bdf3fe6f1ef0

Lookout Uyghur Campaign

ATTACK:mobile:S0311 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc7639c8-0e52-4f6f-9cf3-7840be81ad55

paloalto_yispecter_1015

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.