aol.pm

Web Protocols

Subtechnique · ATTACK:mobile:T1437.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1437.001",
  "title": "Web Protocols",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1437/001",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--2282a98b-5049-4f61-9381-55baca7c1add",
  "external_id": "T1437.001",
  "domain": "mobile",
  "created": "2022-04-01T19:06:27.177Z",
  "modified": "2026-05-12T15:12:00.622Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-29.html",
      "external_id": "APP-29"
    }
  ]
}

Explicit source assertions (52)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0972d3cf-717e-4ed2-a89d-9cbe61081956

Talos GPlayed

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c49a6e0-9837-424d-877b-4e232f5fe250

welivesec_strongpity

ATTACK:mobile:S1093 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cf39d51-2d80-4576-b088-e787b113513e

Zimperium FlyTrap

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0df1f5d1-f2fd-441e-b3ce-bcd64f5f5f50

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e9968b7-ad1e-440d-9fe3-2599a1571f39

Cybereason EventBot

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1016d630-94c2-4826-8612-cb1beac51512

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e822ff0-b1e1-4d80-b1a2-956919511809

welivesecurity_ahrat_0523

ATTACK:mobile:S0555 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22f5308c-77ee-4198-be1c-54062aa6a613

CYBERWARCON CHEMISTGAMES

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2836dc3d-cbea-493b-af31-5f1fa8279ec2

SecurityIntelligence TrickMo

ATTACK:mobile:S0308 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cdd5474-620c-499e-8b9c-835505febc2c

Kaspersky-MobileMalware

ATTACK:mobile:S0307 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--319d46b5-de41-4f23-9001-2fa75f954720

Kaspersky-MobileMalware

ATTACK:mobile:S0403 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--327d0102-2113-4e12-be68-504db097a6fd

Kaspersky Riltok June 2019

ATTACK:mobile:T1437.001 → subtechnique-of → ATTACK:mobile:T1437

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34b6abb0-d199-46bb-af21-b65560e75658

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3598ab6e-9271-40ca-9771-b9a6bbce497c

cyble_chameleon_0423

ATTACK:mobile:S0326 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3644d1dd-8d9f-4a89-a618-c6b22c2a1a96

Wandera-RedDrop

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--375ead49-d7ac-4664-bd46-a266764cddc8

ZimperiumOrtegaPratapagiri_GodFather_Jun2025

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--395cb6b2-0848-43c7-ac4a-617e103fb66a

Symantec GoldenCup

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3acbaa64-fb6e-4c26-ada4-1aab88798265

Lookout Uyghur Campaign

ATTACK:mobile:S0304 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b0cb886-dabc-4622-b91f-3851e2a71bf2

Kaspersky-WUC

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f47f048-badd-4476-8534-d06e20c02ec6

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--418168ad-fee9-42c8-ac27-11f7472a5f86

SWB Exodus March 2019

ATTACK:mobile:S0313 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d7e937d-7ea1-49cb-939c-5244815e51d7

FireEye-RuMMS

ATTACK:mobile:S0306 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54151897-cc7e-4f92-af50-bed41ea78d92

Kaspersky-MobileMalware

ATTACK:mobile:S0525 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59d463d3-3a41-4269-be9a-7a69f44eca78

WeLiveSecurity AdDisplayAshas

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a50d9da-3fa5-443e-8367-8a0520d58cae

Lookout Uyghur Campaign

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d37400f-80f9-4500-9357-185650e5a7b2

lookout_abstractemu_1021

ATTACK:mobile:S0426 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--605d95a1-0493-418e-9d81-de58531c4421

TrendMicro Coronavirus Updates

ATTACK:mobile:G0070 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61071d73-fcdf-4820-afd0-e3f0983e0a71

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0311 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76cc66f4-ce85-4873-a63e-879b4a14a540

paloalto_yispecter_1015

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d2f869d-a117-4b1f-a783-c6d3fc002562

lookout_bouldspy_0423

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82a51cc3-7a91-43b0-9147-df5983e52b41

Securelist Asacub

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8570b7ef-a84d-480e-b1ca-b15f15d12103

securelist rotexy 2018

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85e0d8c5-b9d6-4a10-963a-aeb54eba4f02

CheckPoint Cerberus

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f2929a9-cd25-4e07-b402-447da68aaa56

TrendMicro Coronavirus Updates

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90d4d964-efa2-46ac-adc2-759886e07158

Threat Fabric Exobot

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98420345-5cf0-4145-b41b-54001847edb0

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98a4a746-e7bf-494c-9ee3-584403d76d3e

proofpoint_flubot_0421

ATTACK:mobile:S0432 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9cfcda7d-bb82-4122-a38b-fec4f5532856

Google Bread

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1ff77ee-76fd-4dd3-94aa-dbf35d971e58

cleafy_brata_0122

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5dac41f-4a16-44ea-b279-b84c927ce62d

Talos Gustuff Apr 2019

ATTACK:mobile:S0479 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a95fe853-d1d1-47dc-a776-b905daacfe32

ESET DEFENSOR ID

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aad084c4-97ea-4f4b-8d96-d18f57534e01

sophos_android_apt_spyware · welivesecurity_apt-c-23

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abf03652-acd0-4361-8a66-f7e70e8e4376

Volexity Insomnia

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba02a1dc-d5b9-41cb-9adf-883119e1aa51

Sophos Red Alert 2.0

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbc6308e-f7f6-40c7-80cb-f760d623c8af

nccgroup_sharkbot_0322

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d59da983-c521-47b6-83ab-435f7d58611d

SecureList - ViceLeaker 2019 · Bitdefender - Triout 2018

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0121f6c-0312-4fff-9d6c-0a8aea945bea

threatfabric_sova_0921

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e42c671c-6a8e-4ed5-a4cb-68e57613244f

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025

ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e93da850-00b9-4ddf-bf9f-b1a4beeb61b5

CERTPL_NGate_Nov2025 · ESETStefanko_NGateVariant_Apr2026

ATTACK:mobile:S1225 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4b0d3ea-ae51-4e3b-a642-8a853f583436

TrendMicro_CherryBlos_July2023

ATTACK:mobile:S0327 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f62e0aaf-e52f-40b9-a059-001f298a0660

Kaspersky-Skygofree

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa13936f-9b9d-4b48-a33f-81044f6cdedb

Cybereason FakeSpy

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.