MITRE ATT&CKsoftware (malware)

S9005 DocSwap

Published 2026-02-16 Modified 2026-04-23 Official page ↗
Domain
mobile
Platforms
Android
Version
1.0
Created
2026-02-16

Description

DocSwap is an Android malware first identified in 2025, and attributed to Kimsuky. DocSwap’s name is a combination of its Korean name “문서열람 인증 앱” (Document Viewing Authentication App) and a phishing page masquerading as CoinSwap at the C2 address. Based on DocSwap’s name and Korean-language strings, DocSwap potentially targets mobile device users in South Korea. Several variants of DocSwap exist; one of the latest samples indicates that the adversary added a native decryption function that decrypts an internal APK.

Related

Uses · MITRE ATT&CK (27)

  • T1636.005 Accounts sub-technique
  • T1422.002 Wi-Fi Discovery sub-technique
  • T1660 Phishing technique
  • T1655.001 Match Legitimate Name or Location sub-technique
  • T1417.001 Keylogging sub-technique
  • T1437.001 Web Protocols sub-technique
  • T1636.002 Call Log sub-technique
  • T1636.003 Contact List sub-technique
  • T1636.004 SMS Messages sub-technique
  • T1646 Exfiltration Over C2 Channel technique
  • T1624.001 Broadcast Receivers sub-technique
  • T1627 Execution Guardrails technique
  • T1630.002 File Deletion sub-technique
  • T1616 Call Control technique
  • T1575 Native API technique
  • T1544 Ingress Tool Transfer technique
  • T1541 Foreground Persistence technique
  • T1533 Data from Local System technique
  • T1512 Video Capture technique
  • T1406 Obfuscated Files or Information technique
  • T1418 Software Discovery technique
  • T1420 File and Directory Discovery technique
  • T1422 System Network Configuration Discovery technique
  • T1426 System Information Discovery technique
  • T1429 Audio Capture technique
  • T1430 Location Tracking technique
  • T1453 Abuse Accessibility Features technique

References