MITRE ATT&CKsoftware (malware)
S9006 VajraSpy
- Domain
- mobile
- Platforms
- Android
- Version
- 1.0
- Created
- 2026-03-09
Description
VajraSpy is Android malware distributed via trojanized messaging and news applications. It has been used to target individuals in Pakistan and India since at least 2021 and has been delivered through the Google Play Store, malicious domains, and other uncontrolled distribution channels. VajraSpy is attributed with high confidence to Patchwork which has used the malware to conduct targeted espionage, primarily against devices in Pakistan.
Related
Uses · MITRE ATT&CK (23)
- T1636.005 Accounts sub-technique
- T1422.002 Wi-Fi Discovery sub-technique
- T1660 Phishing technique
- T1655 Masquerading technique
- T1481.002 Bidirectional Communication sub-technique
- T1639.001 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
- T1417.001 Keylogging sub-technique
- T1636.002 Call Log sub-technique
- T1636.003 Contact List sub-technique
- T1636.004 SMS Messages sub-technique
- T1646 Exfiltration Over C2 Channel technique
- T1616 Call Control technique
- T1533 Data from Local System technique
- T1517 Access Notifications technique
- T1512 Video Capture technique
- T1409 Stored Application Data technique
- T1418 Software Discovery technique
- T1420 File and Directory Discovery technique
- T1426 System Information Discovery technique
- T1429 Audio Capture technique
- T1430 Location Tracking technique
- T1453 Abuse Accessibility Features technique
- T1461 Lockscreen Bypass technique
Referenced by MITRE ATT&CK · uses (1)
- G0040 Patchwork group
References
- https://arcticwolf.com/resources/blog/dropping-elephant-apt-group-targets-turkish-defense-industry/ ArcticWolf_DroppingElephant_July2025
- https://labs.k7computing.com/index.php/vajraspy-an-android-rat/ K7Dhanalakshmi_VajraSpy_April2022
- https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/ ESET_VajraSpy_Feb2024