auren-research/cyber-sec huggingface dataset:
type: malware
spec_version: 2.1
id: malware--41e3fd01-7b83-471f-835d-d2b1dc9a770c
created: 2017-10-25T14:48:42.313Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0302
external_id: S0302
source_name: Twitoor
description: (Citation: ESET-Twitoor)
source_name: ESET-Twitoor
description: ESET. (2016, August 24). First Twitter-controlled Android botnet discovered. Retrieved December 22, 2016.
url: http://www.welivesecurity.com/2016/08/24/first-twitter-controlled-android-botnet-discovered/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:24.958Z
name: Twitoor
description: [Twitoor](https://attack.mitre.org/software/S0302) is a dropper application capable of receiving commands from social media.(Citation: ESET-Twitoor)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Twitoor
modified: 2023-10-11T14:36:39.396Z
name: Fakecalls
description: [Fakecalls](https://attack.mitre.org/software/S1080) is an Android trojan, first detected in January 2021, that masquerades as South Korean banking apps. It has capabilities to intercept calls to banking institutions and even maintain realistic dialogues with the victim using pre-recorded audio snippets.(Citation: kaspersky_fakecalls_0422) 
is_family: yes
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_contributors: Pooja Natarajan, NEC Corporation India
Hiroki Nagahama, NEC Corporation
Manikantan Srinivasan, NEC Corporation India
x_mitre_aliases: Fakecalls
type: malware
spec_version: 2.1
id: malware--429e1526-6293-495b-8808-af7f9a66c4be
created: 2023-07-21T19:49:44.577Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1080
external_id: S1080
source_name: kaspersky_fakecalls_0422
description: Igor Golovin. (2022, April 11). Fakecalls: a talking Trojan. Retrieved July 21, 2023.
url: https://www.kaspersky.com/blog/fakecalls-banking-trojan/44072/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--4b53eb01-57d7-47b4-b078-22766b002b36
created: 2023-02-06T19:34:43.026Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1062
external_id: S1062
source_name: cleafy_sova_1122
description: Francesco Lubatti, Federico Valentini. (2022, November 8). SOVA malware is back and is evolving rapidly. Retrieved March 30, 2023.
url: https://www.cleafy.com/cleafy-labs/sova-malware-is-back-and-is-evolving-rapidly
source_name: threatfabric_sova_0921
description: ThreatFabric. (2021, September 9). S.O.V.A. - A new Android Banking trojan with fowl intentions. Retrieved February 6, 2023.
url: https://www.threatfabric.com/blogs/sova-new-trojan-with-fowl-intentions.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:22:08.121Z
name: S.O.V.A.
description: [S.O.V.A.](https://attack.mitre.org/software/S1062) is an Android banking trojan that was first identified in August 2021 and has subsequently been found in a variety of applications, including banking, cryptocurrency wallet/exchange, and shopping apps. [S.O.V.A.](https://attack.mitre.org/software/S1062), which is Russian for "owl", contains features not commonly found in Android malware, such as session cookie theft.(Citation: threatfabric_sova_0921)(Citation: cleafy_sova_1122)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: S.O.V.A.
type: malware
spec_version: 2.1
id: malware--4bf6ba32-4165-42c1-b911-9c36165891c8
created: 2017-10-25T14:48:47.965Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0310
external_id: S0310
source_name: ANDROIDOS_ANSERVER.A
description: (Citation: TrendMicro-Anserver)
source_name: TrendMicro-Anserver
description: Karl Dominguez. (2011, October 2). Android Malware Uses Blog Posts as C&C. Retrieved February 6, 2017.
url: http://blog.trendmicro.com/trendlabs-security-intelligence/android-malware-uses-blog-posts-as-cc/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:25.685Z
name: ANDROIDOS_ANSERVER.A
description: [ANDROIDOS_ANSERVER.A](https://attack.mitre.org/software/S0310) is Android malware that is unique because it uses encrypted content within a blog site for command and control. (Citation: TrendMicro-Anserver)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.3
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: ANDROIDOS_ANSERVER.A
type: malware
spec_version: 2.1
id: malware--507fe748-5e4a-4b45-9e9f-8b1115f4e878
created: 2017-10-25T14:48:41.721Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0315
external_id: S0315
source_name: DualToy
description: (Citation: PaloAlto-DualToy)
source_name: PaloAlto-DualToy
description: Claud Xiao. (2016, September 13). DualToy: New Windows Trojan Sideloads Risky Apps to Android and iOS Devices. Retrieved January 24, 2017.
url: https://researchcenter.paloaltonetworks.com/2016/09/dualtoy-new-windows-trojan-sideloads-risky-apps-to-android-and-ios-devices/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:26.050Z
name: DualToy
description: [DualToy](https://attack.mitre.org/software/S0315) is Windows malware that installs malicious applications onto Android and iOS devices connected over USB. (Citation: PaloAlto-DualToy)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: malware
spec_version: 2.1
id: malware--52c994fa-b6c8-45a8-9586-a4275cf19307
created: 2020-07-15T20:20:58.846Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0485
external_id: S0485
source_name: oxide
description: (Citation: Bitdefender Mandrake)
source_name: briar
description: (Citation: Bitdefender Mandrake)
source_name: ricinus
description: (Citation: Bitdefender Mandrake)
source_name: darkmatter
description: (Citation: Bitdefender Mandrake)
source_name: Bitdefender Mandrake
description: R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.
url: https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:26.424Z
name: Mandrake
description: [Mandrake](https://attack.mitre.org/software/S0485) is a sophisticated Android espionage platform that has been active in the wild since at least 2016. [Mandrake](https://attack.mitre.org/software/S0485) is very actively maintained, with sophisticated features and attacks that are executed with surgical precision.

[Mandrake](https://attack.mitre.org/software/S0485) has gone undetected for several years by providing legitimate, ad-free applications with social media and real reviews to back the apps. The malware is only activated when the operators issue a specific command.(Citation: Bitdefender Mandrake)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Mandrake
oxide
briar
ricinus
darkmatter
modified: 2024-04-10T21:58:07.962Z
name: HilalRAT
description: [HilalRAT](https://attack.mitre.org/software/S1128) is a remote access-capable Android malware, developed and used by [UNC788](https://attack.mitre.org/groups/G1029).(Citation: Meta Adversarial Threat Report 2022) [HilalRAT](https://attack.mitre.org/software/S1128) is capable of collecting data, such as device location, call logs, etc., and is capable of executing actions, such as activating a device's camera and microphone.(Citation: Meta Adversarial Threat Report 2022) 
is_family: yes
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_contributors: Denise Tan
x_mitre_aliases: HilalRAT
type: malware
spec_version: 2.1
id: malware--55714f87-6178-4b89-b3e5-d3a643f647ca
created: 2024-04-02T19:01:36.303Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1128
external_id: S1128
source_name: Meta Adversarial Threat Report 2022
description: Agranovich, D., et al. (2022, April). Adversarial Threat Report. Retrieved April 2, 2024.
url: https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--56660521-6db4-4e5a-a927-464f22954b7c
created: 2017-10-25T14:48:42.034Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0314
external_id: S0314
source_name: X-Agent for Android
description: (Citation: CrowdStrike-Android)
source_name: CrowdStrike-Android
description: CrowdStrike Global Intelligence Team. (2016). Use of Fancy Bear Android Malware in Tracking of Ukrainian FIeld Artillery Units. Retrieved February 6, 2017.
url: https://www.crowdstrike.com/wp-content/brochures/FancyBearTracksUkrainianArtillery.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:26.968Z
name: X-Agent for Android
description: [X-Agent for Android](https://attack.mitre.org/software/S0314) is Android malware that was placed in a repackaged version of a Ukrainian artillery targeting application. The malware reportedly retrieved general location data on where the victim device was used, and therefore could likely indicate the potential location of Ukrainian artillery. (Citation: CrowdStrike-Android) Is it tracked separately from the [CHOPSTICK](https://attack.mitre.org/software/S0023).
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: malware
spec_version: 2.1
id: malware--5a5dca4c-03c1-4b99-bfcf-c206e20aa663
created: 2020-06-26T15:12:39.648Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0479
external_id: S0479
source_name: ESET DEFENSOR ID
description: L. Stefanko. (2020, May 22). Insidious Android malware gives up all malicious features but one to gain stealth. Retrieved June 26, 2020.
url: https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:27.329Z
name: DEFENSOR ID
description: [DEFENSOR ID](https://attack.mitre.org/software/S0479) is a banking trojan capable of clearing a victim’s bank account or cryptocurrency wallet and taking over email or social media accounts. [DEFENSOR ID](https://attack.mitre.org/software/S0479) performs the majority of its malicious functionality by abusing Android’s accessibility service.(Citation: ESET DEFENSOR ID) 
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Lukáš Štefanko, ESET
x_mitre_aliases: DEFENSOR ID
modified: 2024-04-17T17:06:28.821Z
name: BRATA
description: [BRATA](https://attack.mitre.org/software/S1094) (Brazilian Remote Access Tool, Android), is an evolving Android malware strain, detected in late 2018 and again in late 2021. Originating in Brazil, [BRATA](https://attack.mitre.org/software/S1094) was later also found in the UK, Poland, Italy, Spain, and USA, where it is believed to have targeted financial institutions such as banks. There are currently three known variants of [BRATA](https://attack.mitre.org/software/S1094).(Citation: securelist_brata_0819)(Citation: cleafy_brata_0122)(Citation: mcafee_brata_0421)
is_family: yes
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_contributors: Pooja Natarajan, NEC Corporation India
x_mitre_aliases: BRATA
type: malware
spec_version: 2.1
id: malware--5aff44ab-5a41-49bb-b5d1-b4876d0437f4
created: 2023-12-18T18:06:22.975Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1094
external_id: S1094
source_name: cleafy_brata_0122
description: Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.
url: https://www.cleafy.com/cleafy-labs/how-brata-is-monitoring-your-bank-account
source_name: mcafee_brata_0421
description: Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/brata-keeps-sneaking-into-google-play-now-targeting-usa-and-spain/
source_name: securelist_brata_0819
description: Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
url: https://securelist.com/spying-android-rat-from-brazil-brata/92775/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--5ddf81ea-2c06-497b-8c30-5f1ab89a40f9
created: 2017-10-25T14:48:40.875Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0303
external_id: S0303
source_name: MazarBOT
description: (Citation: Tripwire-MazarBOT)
source_name: Tripwire-MazarBOT
description: Graham Cluley. (2016, February 16). Android users warned of malware attack spreading via SMS. Retrieved December 23, 2016.
url: https://www.tripwire.com/state-of-security/security-data-protection/android-malware-sms/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:28.053Z
name: MazarBOT
description: [MazarBOT](https://attack.mitre.org/software/S0303) is Android malware that was distributed via SMS in Denmark in 2016. (Citation: Tripwire-MazarBOT)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: malware
spec_version: 2.1
id: malware--6146be90-470c-4049-bb3a-9986b8ffb65b
created: 2020-04-08T15:51:24.862Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0423
external_id: S0423
source_name: ThreatFabric Ginp
description: ThreatFabric. (2019, November). Ginp - A malware patchwork borrowing from Anubis. Retrieved April 8, 2020.
url: https://www.threatfabric.com/blogs/ginp_a_malware_patchwork_borrowing_from_anubis.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:28.434Z
name: Ginp
description: [Ginp](https://attack.mitre.org/software/S0423) is an Android banking trojan that has been used to target Spanish banks. Some of the code was taken directly from [Anubis](https://attack.mitre.org/software/S0422).(Citation: ThreatFabric Ginp)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Aviran Hazum, Check Point
Sergey Persikov, Check Point
x_mitre_aliases: Ginp
type: malware
spec_version: 2.1
id: malware--6447e3a1-ef4d-44b1-99d5-6b1c4888674f
created: 2017-10-25T14:48:40.259Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0321
external_id: S0321
source_name: HummingWhale
description: (Citation: ArsTechnica-HummingWhale)
source_name: ArsTechnica-HummingWhale
description: Dan Goodin. (2017, January 23). Virulent Android malware returns, gets >2 million downloads on Google Play. Retrieved January 24, 2017.
url: http://arstechnica.com/security/2017/01/virulent-android-malware-returns-gets-2-million-downloads-on-google-play/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:28.796Z
name: HummingWhale
description: [HummingWhale](https://attack.mitre.org/software/S0321) is an Android malware family that performs ad fraud. (Citation: ArsTechnica-HummingWhale)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2024-03-29T15:07:58.675Z
name: eSurv
description: [eSurv](https://attack.mitre.org/software/S0507) is mobile surveillanceware designed for the lawful intercept market that was developed over the course of many years.(Citation: Lookout eSurv)
is_family: yes
x_mitre_platforms: Android
iOS
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.1
x_mitre_aliases: eSurv
type: malware
spec_version: 2.1
id: malware--680f680c-eef9-4f8a-b5f5-f451bf47e403
created: 2020-09-14T14:13:45.032Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0507
external_id: S0507
source_name: Lookout eSurv
description: A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.
url: https://blog.lookout.com/esurv-research
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: malware
spec_version: 2.1
id: malware--68156e5a-4c3a-46dd-9c5e-c0bfdec6651f
created: 2023-02-28T21:39:52.744Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1069
external_id: S1069
source_name: cloudmark_tanglebot_0921
description: Felipe Naves, Andrew Conway, W. Stuart Jones, Adam McNeil . (2021, September 23). TangleBot: New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures. Retrieved February 28, 2023.
url: https://www.cloudmark.com/en/blog/malware/tanglebot-new-advanced-sms-malware-targets-mobile-users-across-us-and-canada-covid-19
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:22:09.556Z
name: TangleBot
description: [TangleBot](https://attack.mitre.org/software/S1069) is SMS malware that was initially observed in September 2021, primarily targeting mobile users in the United States and Canada. [TangleBot](https://attack.mitre.org/software/S1069) has used SMS text message lures about COVID-19 regulations and vaccines to trick mobile users into downloading the malware, similar to [FluBot](https://attack.mitre.org/software/S1067) Android malware campaigns.(Citation: cloudmark_tanglebot_0921)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: TangleBot
type: malware
spec_version: 2.1
id: malware--6a7aaab1-3e0a-48bb-ba66-bbf7665c0a65
created: 2019-09-04T14:28:14.181Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0407
external_id: S0407
source_name: Lookout-Monokle
description: Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
url: https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:40:29.512Z
name: Monokle
description: [Monokle](https://attack.mitre.org/software/S0407) is targeted, sophisticated mobile surveillanceware. It is developed for Android, but there are some code artifacts that suggests an iOS version may be in development.(Citation: Lookout-Monokle)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Jörg Abraham, EclecticIQ
x_mitre_aliases: Monokle
type: malware
spec_version: 2.1
id: malware--6ceb0644-0ae9-4ee1-a659-3888687cb03b
created: 2025-09-18T14:36:13.709Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1241
external_id: S1241
source_name: ZimperiumGupta_RatMilad_Oct2022
description: Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.
url: https://zimperium.com/blog/we-smell-a-ratmilad-mobile-spyware
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T03:26:04.908Z
name: RatMilad
description: [RatMilad](https://attack.mitre.org/software/S1241) is an Android remote access tool (RAT) with spyware functionality that has been used to target enterprise mobile devices in the Middle East since at least 2021. Variants of [RatMilad](https://attack.mitre.org/software/S1241) have been disguised as VPN applications and a fake app named NumRent. Upon installation, [RatMilad](https://attack.mitre.org/software/S1241) employs multiple [Collection](https://attack.mitre.org/tactics/TA0035) techniques to collect sensitive information before uploading the collected data to its command and control (C2) server. (Citation: ZimperiumGupta_RatMilad_Oct2022)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Google's Android Security team
x_mitre_aliases: RatMilad