Device Lockout

Subtechnique · ATTACK:mobile:T1629.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1629.002",
  "title": "Device Lockout",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1629/002",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--acf8fd2a-dc98-43b4-8d37-64e10728e591",
  "external_id": "T1629.002",
  "domain": "mobile",
  "created": "2022-04-01T18:49:03.892Z",
  "modified": "2025-10-24T17:49:13.285Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion"
  ],
  "source_references": [
    {
      "source_name": "Microsoft MalLockerB",
      "url": "https://www.microsoft.com/security/blog/2020/10/08/sophisticated-new-android-malware-marks-the-latest-evolution-of-mobile-ransomware/"
    },
    {
      "source_name": "Android resetPassword",
      "url": "https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#resetPassword(java.lang.String,%20int)"
    },
    {
      "source_name": "securelist rotexy 2018",
      "url": "https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/"
    },
    {
      "source_name": "Talos GPlayed",
      "url": "https://blog.talosintelligence.com/2018/10/gplayedtrojan.html"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-22.html",
      "external_id": "APP-22"
    }
  ]
}

Explicit source assertions (5)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.