{"description": "Mobile techniques used by KoSpy, ATT&CK software S9048 (v1.0)", "name": "KoSpy (S9048)", "domain": "mobile-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1437", "showSubtechniques": true}, {"techniqueID": "T1437.001", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has used an HTTP POST request with a payload in JSON format to obtain configuration data.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1532", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has encrypted collected data with a hardcoded AES key.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1429", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has recorded audio using dynamically loaded plugins.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1476", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has been distributed via the third-party application store Apkpure.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1420", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has accessed files and folders in the local storage using dynamically loaded plugins.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1417", "showSubtechniques": true}, {"techniqueID": "T1417.001", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has recorded keystrokes by abusing accessibility features.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1430", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has collected the device\u2019s location using dynamically loaded plugins.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1655", "showSubtechniques": true}, {"techniqueID": "T1655.001", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has masqueraded as legitimate applications, such as \u201cFile Manager, \u201cSoftware Update Utility,\u201d and \u201cKakao Security.\u201d(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1406", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has encrypted and encoded values with Base64 during C2 communication initialization.  ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1636", "showSubtechniques": true}, {"techniqueID": "T1636.002", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has collected call logs using dynamically loaded plugins.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1636.004", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has collected SMS messages using dynamically loaded plugins.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1513", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has captured screenshots and recordings of the device screen using dynamically loaded plugins.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1418", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has collected a list of installed applications using dynamically loaded plugins.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1422", "showSubtechniques": true}, {"techniqueID": "T1422.002", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has collected Wi-Fi network details using dynamically loaded plugins.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1512", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has taken pictures with the device\u2019s cameras using dynamically loaded plugins.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1633", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has checked if the device is not an emulator and if the current date is past the hardcoded activation date.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1481", "showSubtechniques": true}, {"techniqueID": "T1481.002", "comment": "[KoSpy](https://attack.mitre.org/software/S9048) has used Firebase Firestore to receive configuration data: an \u201con\u201d/\u201doff\u201d switch and the C2 server address.(Citation: Lookout_KoSpy_March2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by KoSpy", "color": "#66b1ff"}]}