MITRE ATT&CKsoftware (malware)

S1077 Hornbill

Published 2023-06-09 Modified 2023-10-07 Official page ↗
Domain
mobile
Platforms
Android
Version
1.0
Created
2023-06-09

Description

Hornbill is one of two mobile malware families known to be used by the APT Confucius. Analysis suggests that Hornbill was first active in early 2018. While Hornbill and Sunbird overlap in core capabilities, Hornbill has tools and behaviors suggesting more passive reconnaissance.

Related

Uses · MITRE ATT&CK (21)

  • T1422.002 Wi-Fi Discovery sub-technique
  • T1422.001 Internet Connection Discovery sub-technique
  • T1655.001 Match Legitimate Name or Location sub-technique
  • T1628.002 User Evasion sub-technique
  • T1437.001 Web Protocols sub-technique
  • T1626.001 Device Administrator Permissions sub-technique
  • T1636.002 Call Log sub-technique
  • T1636.003 Contact List sub-technique
  • T1646 Exfiltration Over C2 Channel technique
  • T1630.002 File Deletion sub-technique
  • T1533 Data from Local System technique
  • T1517 Access Notifications technique
  • T1512 Video Capture technique
  • T1513 Screen Capture technique
  • T1409 Stored Application Data technique
  • T1418 Software Discovery technique
  • T1420 File and Directory Discovery technique
  • T1422 System Network Configuration Discovery technique
  • T1426 System Information Discovery technique
  • T1429 Audio Capture technique
  • T1430 Location Tracking technique

Referenced by MITRE ATT&CK · uses (1)

References