Activity timeline
T1409 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 5 reports, and 15 of the 15 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1409 Stored Application Data is catalogued by MITRE ATT&CK under the Collection (Mobile) tactic in the Mobile matrix. Threadlinqs maps 15 of 2623 tracked threats (0.6%) to it; by severity that is 3 critical, 10 high, 1 medium.
Threats that use T1409 most often also use T1426 System Information Discovery (12 threats), T1646 Exfiltration Over C2 Channel (11 threats), T1430 Location Tracking (10 threats), T1404 Exploitation for Privilege Escalation (9 threats), T1660 Phishing (9 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1409; the most frequent are NSO Group (3).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1409.
Threat actors using it
Tracked threats
15 tracked threats use T1409.
- GitHub Security Lab AI Agent Uncovers 24 Android App Vulnerabilities, Including OsmAnd Location-Tracking…medium
- Zero-Permission Android Apps Can Chain AtlasService and olc2 to Gain Root on OnePlus/OPPO Devices via…high
- FomoPeek iOS App Store Poisoning: Kernel Exploit Framework Steals Crypto Private Keys via Keychain Decryptioncritical
- Pegasus Spyware Used to Hack Phone of Former MEP Stelios Kouloglou, PEGA Committee Memberhigh
- Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…high
- NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions…
- SparkKitty: Cross-Platform iOS/Android Stealer Using OCR to Harvest Crypto Wallet Seed Phrases from App…high
- Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committeecritical
- European Parliament Member Investigating Pegasus Spyware Hacked With Pegasus (PWNYOURHOME Zero-Click Exploit…critical
- Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…high
- Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…high
- NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)high
- BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…high
- NGate Android NFC Relay Malware Variant - Trojanized HandyPay Banking App Campaign Targeting Brazil…high
- NGate Android Malware — HandyPay-Trojanized NFC Relay Variant Targets Brazilian Cardholders via Fake Rio de…high
Detection coverage
Threadlinqs maintains 22 detection rules mapped to T1409 (SPL 6, KQL 9, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only.