# T1398 Boot or Logon Initialization Scripts > As of 2026-11-03, T1398 (Boot or Logon Initialization Scripts) appears in 10 tracked threats, first reported 2026-02-16 and most recently 2026-11-02, with linked actors including NSO Group; it most often appears alongside T1646 (Exfiltration Over C2 Channel). - **Tracked threats:** 10 (9 high, 1 medium) - **First seen:** 2026-02-16 - **Last seen:** 2026-11-02 - **Threat actors:** 1 - **Detection rules:** 12 (counts only; unlock with TL Creds) ## Key facts - **ID:** T1398 - **Framework:** MITRE ATT&CK - **Tactics:** Persistence (Mobile) - **Matrix:** Mobile - **Data as of:** 2026-11-03 - **MITRE:** https://attack.mitre.org/techniques/T1398/ ## Activity timeline T1398 first appeared in tracked threats on 2026-02-16 and was most recently reported on 2026-11-02. The busiest month was 2026-02 with 2 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11. ## How adversaries use it T1398 Boot or Logon Initialization Scripts is catalogued by MITRE ATT&CK under the Persistence (Mobile) tactic in the Mobile matrix. Threadlinqs maps 10 of 3541 tracked threats (0.3%) to it; by severity that is 9 high, 1 medium. Threats that use T1398 most often also use [T1646 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1646) (10 threats), [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (9 threats), [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (8 threats), [T1513 Screen Capture](https://intel.threadlinqs.com/technique/T1513) (8 threats), [T1418 Software Discovery](https://intel.threadlinqs.com/technique/T1418) (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 1 tracked threat actor appear in the threats that use T1398; the most frequent are [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) (1). ## Mitigations MITRE ATT&CK lists 4 mitigations for T1398. - [M1001 Security Updates](https://attack.mitre.org/mitigations/M1001/) - [M1002 Attestation](https://attack.mitre.org/mitigations/M1002/) - [M1003 Lock Bootloader](https://attack.mitre.org/mitigations/M1003/) - [M1004 System Partition Integrity](https://attack.mitre.org/mitigations/M1004/) ## Threat actors using it - [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) — 1 ## Tracked threats 10 tracked threats use T1398. - [XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Google](https://intel.threadlinqs.com/threat/TL-2026-5057) — high — 2026-11-02 - [MR ROBOT Android Malware-as-a-Service Targeting Indian Bank Customers](https://intel.threadlinqs.com/threat/TL-2026-4615) — high — 2026-10-28 - [Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…](https://intel.threadlinqs.com/threat/TL-2026-2316) — high — 2026-09-03 - [Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal…](https://intel.threadlinqs.com/threat/TL-2026-1832) — high — 2026-08-03 - [Copybara Android RAT Delivered via Fake N26 Support Vishing Calls](https://intel.threadlinqs.com/threat/TL-2026-1804) — high — 2026-08-01 - [ESET H1 2026 Threat Report: Malicious AI Agent Skills Surge Fivefold to 3,000+ Entries; PromptSpy Debuts as…](https://intel.threadlinqs.com/threat/TL-2026-1798) — medium — 2026-07-31 - ["BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platform](https://intel.threadlinqs.com/threat/TL-2026-1636) — high — 2026-07-22 - [Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…](https://intel.threadlinqs.com/threat/TL-2026-0751) — high — 2026-06-10 - [PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote…](https://intel.threadlinqs.com/threat/TL-2026-0135) — high — 2026-02-23 - [ZeroDayRAT Commercial Mobile Spyware — Telegram-Sold Cross-Platform Android/iOS Surveillance, Live…](https://intel.threadlinqs.com/threat/TL-2026-0116) — high — 2026-02-16 ## Related CVEs CVEs referenced by the tracked threats that use T1398, most frequent first. - [CVE-2016-4655](https://intel.threadlinqs.com/cve/CVE-2016-4655) - [CVE-2016-4656](https://intel.threadlinqs.com/cve/CVE-2016-4656) - [CVE-2016-4657](https://intel.threadlinqs.com/cve/CVE-2016-4657) - [CVE-2021-30860](https://intel.threadlinqs.com/cve/CVE-2021-30860) - [CVE-2023-41061](https://intel.threadlinqs.com/cve/CVE-2023-41061) - [CVE-2023-41064](https://intel.threadlinqs.com/cve/CVE-2023-41064) - [CVE-2024-43047](https://intel.threadlinqs.com/cve/CVE-2024-43047) - [CVE-2024-50302](https://intel.threadlinqs.com/cve/CVE-2024-50302) - [CVE-2024-53104](https://intel.threadlinqs.com/cve/CVE-2024-53104) - [CVE-2024-53197](https://intel.threadlinqs.com/cve/CVE-2024-53197) - [CVE-2025-31200](https://intel.threadlinqs.com/cve/CVE-2025-31200) - [CVE-2025-31201](https://intel.threadlinqs.com/cve/CVE-2025-31201) ## Detection coverage Threadlinqs maintains 12 detection rules mapped to T1398 (SPL 2, KQL 5, Sigma 5). Rule content unlocks with TL Creds on a free account; this page shows counts only. 12 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1398 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp