Skip to content

Contact List

Subtechnique · ATTACK:mobile:T1636.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1636.003",
  "title": "Contact List",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1636/003",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86",
  "external_id": "T1636.003",
  "domain": "mobile",
  "created": "2022-04-01T13:17:52.740Z",
  "modified": "2026-05-12T15:12:00.722Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html",
      "external_id": "APP-13"
    }
  ]
}

Explicit source assertions (60)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--049b0c71-63e3-47ce-bb0b-149df0344b15

Lookout Uyghur Campaign

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b1c0282-8190-465a-9944-0874e3ee65f6

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bc73d69-e769-4d0f-9d44-368c94225b6e

Bitdefender Mandrake

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13495d9c-6877-4bc9-888a-7d92362bcb40

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0506 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--173c0c41-c7e3-48e9-b785-d9e0232d85ca

Lookout ViperRAT

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18186ee9-0ae4-405c-bf73-4d9ca1689744

LinkedIn Dmitry LightSpy 2025 · MelikovBlackBerry LightSpy 2024 · Shoshin_Kaspersky LightSpy 2020 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:G0112 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1822e616-ae33-487c-8aa6-4fa81e724184

BlackBerry Bahamut

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f31e348-a4ee-4874-891f-393c65a7640a

lookout_bouldspy_0423

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20aaafe2-1f55-410f-9eb1-1fc979021fe0

Lookout Uyghur Campaign

ATTACK:mobile:S1243 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27cb4c94-c84a-4420-b213-442e4907d8e7

Lookout_DCHSpy_July2025

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--299931f0-4c60-4a9b-8a6a-4adb6362e590

securelist rotexy 2018

ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a5f4f05-bd60-4571-bcce-f3b764a5b5a0

proofpoint_flubot_0421 · Europol FluBot Jun2022

ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3841024e-1047-40fa-9e25-ac6d5c14612a

cloudmark_tanglebot_0921

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e2b9dc1-5da0-46a1-a576-4b41a10f3a60

ATTACK:mobile:S0403 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3efe7dcc-a572-45ac-aff2-2932206a0632

Kaspersky Riltok June 2019

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4009ff40-4616-4b1c-bff9-599e52ccab37

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--437f719c-d602-4cb8-a2b9-c33e85ad7c50

Threat Fabric Cerberus

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43af5696-ac4d-4618-9da9-0784b8f7e433

welivesecurity_ahrat_0523

ATTACK:mobile:S1128 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45383213-4323-4f77-9f9f-360d6d43c128

Meta Adversarial Threat Report 2022

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--476e269e-3c49-4fda-a54b-3f0cb577c5af

Sophos Red Alert 2.0

ATTACK:mobile:S0507 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b838636-bfa4-4592-b72f-3044946b8187

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c7e776d-ed19-4e5a-842c-81612f5c07bd

SWB Exodus March 2019

ATTACK:mobile:S0305 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5012c647-9b58-4a4f-b64f-468c9b76a60c

Zscaler-SpyNote

ATTACK:mobile:S1080 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57881f4b-8463-430c-912a-0e3c961e7784

kaspersky_fakecalls_0422

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58c857f8-4f40-48e0-b3ac-41944d82b576

Lookout Uyghur Campaign

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--642ae344-57b0-4fb4-aa40-43112b484bbc

MerkleScience_Godfather_April2023

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6920d0d0-27f4-4d29-8622-c8a92090eec3

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a87a107-e607-460b-a08c-cc693b15268c

sophos_android_apt_spyware · threatpost AndroidSpyware 2020 · welivesecurity_apt-c-23

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d2c7743-fc75-4524-b217-13867ca1dd10

Talos Gustuff Apr 2019

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76561fe4-98a3-4a7c-8be5-04730cbab146

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7baa3cab-c4f8-4b91-a6c3-189ad7a6416c

Lookout-Pegasus

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e2d9773-1320-4c8f-a595-2b92bf0fd8ed

Lookout Dark Caracal Jan 2018

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--818b8c2b-bd23-4a83-9970-d42063608699

TrendMicro Coronavirus Updates

ATTACK:mobile:S0463 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--875dc21d-92c3-45bf-be37-faa44f4449bf

Google Project Zero Insomnia

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--876fc8ee-aeae-4d4b-b4ce-541b432e5298

Securelist Asacub

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b2c2716-a62b-4c3a-a211-d72bb5ed29b9

Lookout Desert Scorpion

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d3ca04e-867f-4274-bc61-f18c0282a0a9

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f72a070-cfcb-4d75-ace6-b4427f3ba8d3

ATTACK:mobile:S0535 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98dec4bf-6753-4d7a-8983-d4fd6d1d892a

Symantec GoldenCup

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a20581b4-21fa-4ed9-b056-d139998868e8

Lookout-Monokle

ATTACK:mobile:S0328 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2323d47-348c-4e3c-9c25-7feb20e2e457

Lookout-StealthMango

ATTACK:mobile:S0309 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8079e6a-ef87-4e3b-9f71-cf1ea2360892

NYTimes-BackDoor

ATTACK:mobile:S0292 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aaf55dd1-33df-4f02-8025-eaae01f30b33

forcepoint_bitter · Lookout-EnterpriseApps

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad6fb2ac-9e90-44ef-9e59-a65813eca460

K7Dhanalakshmi_VajraSpy_April2022 · ESET_VajraSpy_Feb2024

ATTACK:mobile:T1636.003 → subtechnique-of → ATTACK:mobile:T1636

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b536f233-8c43-4671-b8e8-d72a4806946d

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0d66439-0ae4-4565-8b3a-e92e48e8d3c1

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd503879-ccb4-4d47-af5a-90fe7e37c438

PaloAlto-SpyDealer

ATTACK:mobile:S0304 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfa1d194-7401-46ba-bfed-5f311aeb22d3

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2749285-47d9-44a4-962f-9215e6fb580e

Threat Fabric Exobot

ATTACK:mobile:S1126 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc70704a-54b3-4000-8c55-4919044de5c0

ATTACK:mobile:S0323 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2ee6825-43c2-441f-ba96-404a330a9059

CheckPoint-Charger

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e84ad4b0-9f7a-48a5-89ae-33804b11eb56

Lookout-PegasusAndroid

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8c833ee-4c7d-45a2-b29b-187fe3661c0d

Palo Alto HenBox

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eba4b561-84c9-4d49-a8b8-1842c3ed94f3

lookout_abstractemu_1021

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--edfb68d0-5efd-4fb5-93f9-c432535686cb

CyberMerchants-FlexiSpy

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee92911e-e2a2-4b40-916d-ce01b6e897f9

Cybereason FakeSpy

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f709a4a5-2d7f-4fa8-bad8-a536fd3cc7fc

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f781fd2c-209f-43f1-b55a-fb175187415f

welivesec_strongpity

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7bebe78-2e21-466d-878b-f70be6c0e94a

Zscaler TikTok Spyware

ATTACK:mobile:S0423 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fff16b5e-49c2-45e2-8b3a-fd5f82c96dd9

ThreatFabric Ginp

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.