MITRE ATT&CKsoftware (malware)
S1243 DCHSpy
- Domain
- mobile
- Platforms
- Android
- Version
- 1.0
- Created
- 2025-10-08
Description
DCHSpy is an Android spyware likely used by MuddyWater. DCHSpy uses political decoys and masquerades as legitimate applications, such as VPNs and banking applications, to trick victims into downloading the malware. Once downloaded, DCHSpy collects information from the device and exfiltrates the data to the command and control (C2) server.
Related
Uses · MITRE ATT&CK (12)
- T1636.005 Accounts sub-technique
- T1655.001 Match Legitimate Name or Location sub-technique
- T1636.002 Call Log sub-technique
- T1636.003 Contact List sub-technique
- T1636.004 SMS Messages sub-technique
- T1532 Archive Collected Data technique
- T1533 Data from Local System technique
- T1512 Video Capture technique
- T1409 Stored Application Data technique
- T1429 Audio Capture technique
- T1430 Location Tracking technique
- T1437 Application Layer Protocol technique
Referenced by MITRE ATT&CK · uses (1)
- G0069 MuddyWater group