Activity timeline
T1398 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-02 with 2 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.
How adversaries use it
T1398 Boot or Logon Initialization Scripts is catalogued by MITRE ATT&CK under the Persistence (Mobile) tactic in the Mobile matrix. Threadlinqs maps 10 of 3541 tracked threats (0.3%) to it; by severity that is 9 high, 1 medium.
Threats that use T1398 most often also use T1646 Exfiltration Over C2 Channel (10 threats), T1660 Phishing (9 threats), T1426 System Information Discovery (8 threats), T1513 Screen Capture (8 threats), T1418 Software Discovery (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1398; the most frequent are NSO Group (1).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1398.
Threat actors using it
Tracked threats
10 tracked threats use T1398.
- XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Googlehigh
- MR ROBOT Android Malware-as-a-Service Targeting Indian Bank Customershigh
- Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…high
- Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal…high
- Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh
- ESET H1 2026 Threat Report: Malicious AI Agent Skills Surge Fivefold to 3,000+ Entries; PromptSpy Debuts as…medium
- "BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platformhigh
- Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…high
- PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…high
- ZeroDayRAT Commercial Mobile Spyware — Telegram-Sold Cross-Platform Android/iOS Surveillance, Live…high
Detection coverage
Threadlinqs maintains 12 detection rules mapped to T1398 (SPL 2, KQL 5, Sigma 5). Rule content unlocks with TL Creds on a free account; this page shows counts only.