Data Encrypted for Impact

An adversary may encrypt files stored on the mobile device to prevent the user from accessing them, for example with the intent of only unlocking access to the files after a ransom is paid. Without escalated privileges, the adversary is generally limited to only encrypting files in external/shared storage locations. This technique has been demonstrated on Android. We are unaware of any demonstrated use on iOS.

ID: T1471
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
Tactic: Impact
Platforms: Android
Version: 3.0
Created: 25 October 2017
Last Modified: 01 October 2019

Procedure Examples

ID Name Description
S0422 Anubis

Anubis can use its ransomware module to encrypt device data and hold it for ransom.[1]

S0298 Xbot

Xbot can encrypt the victim's files in external storage (e.g., SD card) and then request a PayPal cash card as ransom.[2]


ID Mitigation Description
M1005 Application Vetting

A static analysis approach may be able to identify ransomware apps that encrypt user files on the device.[3]