MITRE ATT&CKtechnique

T1476 Deliver Malicious Application via Other Means

Published 2018-10-17 Modified 2026-09-03 Official page ↗
Domain
mobile
Tactics
Initial Access
Platforms
Android, iOS
Version
2.0
Created
2018-10-17

Description

Adversaries may direct victims to download malicious applications via ways that avoid an authorized application store (e.g. Google Play Store or Apple App Store). For example, victims may be directed to downloading a malicious APK directly from a domain. Adversaries may wish to avoid placing malicious applications in an authorized application store due to increased potential risk of detection or other reasons. Delivery methods for malicious applications include: • Spearphishing Attachment: including the mobile application package as an attachment to an email • Spearphishing Link: including a link to the mobile application package within an email, text message (e.g. SMS, iMessage, WhatsApp, etc.), web site, QR code, or other means. • Third-Party Application Store: installing the mobile application package from a third-party application store, as opposed to an authorized app store that the device implicitly trusts as part of its default behavior. Third-party application stores may not apply the same level of scrutiny to applications as enforced by an authorized application store. Some Android malware comes with functionality to install additional applications, either automatically or when the adversary instructs it to.

Related

Tactic · MITRE ATT&CK (1)

  • TA0027 Initial Access tactic

Referenced by MITRE ATT&CK · uses (34)

  • S9040 NGate software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0544 HenBox software (malware)
  • S0539 Red Alert 2.0 software (malware)
  • S0540 Asacub software (malware)
  • S0522 Exobot software (malware)
  • S0524 AndroidOS/MalLocker.B software (malware)
  • S0509 FakeSpy software (malware)
  • S0507 eSurv software (malware)
  • S0506 ViperRAT software (malware)
  • S0490 XLoader for iOS software (malware)
  • S0491 StrongPity software (malware)
  • S0480 Cerberus software (malware)
  • G0112 Windshift group
  • S0440 Agent Smith software (malware)
  • S0432 Bread software (malware)
  • S0422 Anubis software (malware)
  • G0097 Bouncing Golf group
  • S0421 GolfSpy software (malware)
  • S0418 ViceLeaker software (malware)
  • S0419 SimBad software (malware)
  • S0411 Rotexy software (malware)
  • S0406 Gustuff software (malware)
  • S0403 Riltok software (malware)
  • S0399 Pallas software (malware)
  • G0070 Dark Caracal group
  • S0318 XLoader for Android software (malware)
  • S0326 RedDrop software (malware)
  • S0287 ZergHelper software (malware)
  • S0302 Twitoor software (malware)
Show all 34 ›

References