Skip to content

Data from Local System

Technique · ATTACK:mobile:T1533

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1533",
  "title": "Data from Local System",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1533",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e1c912a9-e305-434b-9172-8a6ce3ec9c4a",
  "external_id": "T1533",
  "domain": "mobile",
  "created": "2019-10-10T15:12:42.790Z",
  "modified": "2026-05-12T15:12:00.722Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/stack-threats/STA-41.html",
      "external_id": "STA-41"
    }
  ]
}

Explicit source assertions (55)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:C0054 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11e30c59-c1bf-4354-9255-a6eb67d7a79e

SecureList OpTriangulation 23Oct2023

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--122ffed0-5f5a-4588-88a4-16924db24e9e

welivesecurity_apt-c-23

ATTACK:mobile:S1080 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1284ba4a-c48c-4533-ac35-664828616ee3

kaspersky_fakecalls_0422

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16955c8e-65ab-4c9a-a8b1-bec4d5a45f8d

SecureList BusyGasper

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1be8aca9-d5a6-4cc5-9fbe-7625f7ff8d6a

cyble_chameleon_0423 · ThreatFabric_Chameleon_Dec2023

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fdad4b5-18a1-4fbf-81ce-861feaf2bbdd

Trend Micro Anubis · Cofense Anubis

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21ab4328-7908-4fef-9636-d4d162e4a0cf

welivesecurity_ahrat_0523

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--226d2f3c-5d28-4599-9373-d3001f4c4b55

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--295fab07-9f02-4504-9ae4-1a60c2e8c224

Talos Gustuff Apr 2019

ATTACK:mobile:S0577 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2be3d0a4-2e24-4d04-859e-37d24835ff16

Lookout FrozenCell

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--429a4b02-f774-4b1e-aaef-5fd9c654dd09

BlackBerry Bahamut

ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--481e5d33-eca4-453c-9fec-27ee01d50989

cloudmark_tanglebot_0921

ATTACK:mobile:C0016 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c6f1475-3b92-4a37-8bb5-4dcc69660b11

Cylance Dust Storm

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--503ca6f2-a747-43fb-8fc5-7be095dcb966

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55afe9a0-d261-48ea-b5a8-0b1685ff2f15

TrendMicro Coronavirus Updates

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e360913-4986-4423-8d3c-46d3202b7787

Lookout-Monokle

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64ddcf35-dbf0-4b9f-bf07-1e0bde8bbe65

Lookout Uyghur Campaign

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65a24b75-4bb0-441a-8cb2-a34077b13f61

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0507 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a4fd7bd-b73b-403b-aff9-8be6bc0afc7b

ATTACK:mobile:S0301 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cace9e3-f095-4914-bddc-24cec8bcc859

Lookout-Dendroid

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ce36374-2ff6-4b41-8493-148416153232

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f27a13d-b353-47f3-8a71-a13e8c4c3d60

Lookout Desert Scorpion

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75472bf8-c7fd-4fc7-a11e-74189bc23b78

FlexiSpy-Features

ATTACK:mobile:S1126 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7885c84c-b832-42d4-b3d3-49b82849262f

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ec3ee9a-6710-46ed-aecb-c0f2a64739ad

Symantec GoldenCup

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a89f675-4e43-4fe1-8bbd-8e49e07d11be

lookout_bouldspy_0423

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9634001c-575b-47aa-acd2-c3b1e900bd0b

Palo Alto HenBox

ATTACK:mobile:S0426 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97158eda-5092-4939-8b5c-1ef5ab918089

TrendMicro Coronavirus Updates

ATTACK:mobile:S0555 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97738857-d496-4d39-9809-1921e0ad10b7

CYBERWARCON CHEMISTGAMES

ATTACK:mobile:S1054 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98ae9cb2-1141-48c6-81fd-f16adb430031

cyble_drinik_1022

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9bbfa759-5555-4048-a79d-fed27a1efd93

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0290 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a25d58af-dbb3-4025-b91d-898c6adffcb3

Gooligan Citation

ATTACK:mobile:S1215 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a27b771e-430b-4044-aa04-7e755f74ae2f

SecureList OpTriangulation 23Oct2023

ATTACK:mobile:S0295 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a76d731b-484c-442a-b1a3-255d8398aefd

TrendMicro-RCSAndroid

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa65aa77-ce74-49fd-8295-c5b7395a703c

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad723fb0-7439-407e-9bf5-1cb3fd7df8aa

lookout_abstractemu_1021

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7cf1c31-8722-4eeb-ae59-66936c15fa87

Zscaler TikTok Spyware

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9af8369-a6b2-4081-9f07-2ee15d56bffc

Google Project Zero Insomnia

ATTACK:mobile:S0305 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc4e848a-adb7-40a2-94a1-d5ab9854ff0f

Zscaler-SpyNote

ATTACK:mobile:S0329 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf901bab-3caa-4d05-a859-d9fb4d838304

Lookout-StealthMango

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c86918a3-6e41-4dfb-8b18-650fff596801

Lookout ViperRAT

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d056308f-dca7-493e-b152-6f77fa13155d

securelist_brata_0819

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d638565b-ca8e-459f-9c3b-1bd8828606f5

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6f78e9b-94d1-4d59-b00e-89fad2261c55

SecurityIntelligence TrickMo

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dae02ffb-1db5-4b7d-80a9-2a8cbf1bc852

Bleeipng Computer Escobar

ATTACK:mobile:S1243 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3394db9-1cb6-4b7b-9b7e-0e6d15245737

Lookout_DCHSpy_July2025

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4973ce8-5f52-45ac-844d-f73c97a0e040

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7b7e813-4867-46fe-bf86-6f367553d765

SecureList - ViceLeaker 2019 · Bitdefender - Triout 2018

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9b262ba-1c32-40b3-8622-121b30d6df50

SWB Exodus March 2019

ATTACK:mobile:S0423 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f240e06c-3a5b-4a34-a69c-5fccb4c94150

ThreatFabric Ginp

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--faff4998-cc35-44fa-acf9-8fa480c1a0bc

K7Dhanalakshmi_VajraSpy_April2022 · ESET_VajraSpy_Feb2024

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb2a14c1-bed9-4c3f-a60b-8df384c18b68

Lookout Uyghur Campaign

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb51161a-ef2e-41a4-b5f9-bd1f64f95674

Lookout Uyghur Campaign

ATTACK:mobile:S0328 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb5c6c5e-53d4-4bb9-b9cf-74170058b19b

Lookout-StealthMango

ATTACK:mobile:S1216 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc742401-a8cd-4a97-8c50-045807c47581

SecureList OpTriangulation 21Jun2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.