{"description": "Mobile techniques used by NGate, ATT&CK software S9040 (v1.0)", "name": "NGate (S9040)", "domain": "mobile-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1437", "comment": "[NGate](https://attack.mitre.org/software/S9040) has used TCP sockets to communicate with the C2 server.(Citation: CERTPL_NGate_Nov2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1437.001", "comment": "[NGate](https://attack.mitre.org/software/S9040) has used TLS to communicate with the C2 server.(Citation: CERTPL_NGate_Nov2025) [NGate](https://attack.mitre.org/software/S9040) has also used HTTP to communicate with the C2 server.(Citation: ESETStefanko_NGateVariant_Apr2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1623", "comment": "[NGate](https://attack.mitre.org/software/S9040) has used Java to execute a variety of actions, such as loading and verifying runtime configuration and disabling the launcher if decryption or parsing failed.(Citation: CERTPL_NGate_Nov2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1476", "comment": "[NGate](https://attack.mitre.org/software/S9040) has been distributed via files[.]fm and through fake websites that mimic legitimate services, such as banking websites and Rio de Pr\u00eamios, a lottery website.(Citation: ESETStefankoOsmani_NGate_Aug2024)(Citation: CERTPL_NGate_Nov2025)(Citation: ESETStefanko_NGateVariant_Apr2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1646", "comment": "[NGate](https://attack.mitre.org/software/S9040) has exfiltrated the victim\u2019s payment card PIN to the C2 server via HTTP.(Citation: ESETStefanko_NGateVariant_Apr2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1417", "showSubtechniques": true}, {"techniqueID": "T1417.002", "comment": "[NGate](https://attack.mitre.org/software/S9040) has displayed a fake website to collect the user\u2019s banking information.(Citation: ESETStefankoOsmani_NGate_Aug2024) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1655", "showSubtechniques": true}, {"techniqueID": "T1655.001", "comment": "[NGate](https://attack.mitre.org/software/S9040) has used a WhatsApp profile image that impersonated Caixa Econ\u00f4mica Federal, Brazil\u2019s government-owned bank that manages majority of lotteries.(Citation: ESETStefanko_NGateVariant_Apr2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1406", "comment": "[NGate](https://attack.mitre.org/software/S9040) has decrypted ASCII-hex data from the `assets/___` resource, which resulted in a config file that has the host IP address, port, `sharedToken`, and more.(Citation: CERTPL_NGate_Nov2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1644", "comment": "[NGate](https://attack.mitre.org/software/S9040) has used NFC to send the victim's card information through a server to an adversary-controlled device.(Citation: ESETStefankoOsmani_NGate_Aug2024)(Citation: CERTPL_NGate_Nov2025)(Citation: ESETStefanko_NGateVariant_Apr2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1660", "comment": "[NGate](https://attack.mitre.org/software/S9040) has been delivered using malicious links from phishing emails and SMS messages as well as malicious websites that mimic Czech banks.(Citation: ESETStefankoOsmani_NGate_Aug2024)(Citation: CERTPL_NGate_Nov2025) [NGate](https://attack.mitre.org/software/S9040) has also been distributed through a website impersonating a Brazilian lottery (\u201cRio de Pr\u00eamios\u201d) and a fake Google Play web page (\u201cProte\u00e7\u00e3o Cart\u00e3o\u201d).(Citation: ESETStefanko_NGateVariant_Apr2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1421", "comment": "[NGate](https://attack.mitre.org/software/S9040) has requested for the `ACCESS_NETWORK_STATE` permission.(Citation: CERTPL_NGate_Nov2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by NGate", "color": "#66b1ff"}]}