# T1409 Stored Application Data > As of 2026-10-05, T1409 (Stored Application Data) appears in 15 tracked threats, first reported 2026-04-21 and most recently 2026-09-28, with linked actors including NSO Group; it most often appears alongside T1426 (System Information Discovery). - **Tracked threats:** 15 (3 critical, 10 high, 1 medium) - **First seen:** 2026-04-21 - **Last seen:** 2026-09-28 - **Threat actors:** 1 - **Detection rules:** 22 (counts only; Blue tier and above) ## Key facts - **ID:** T1409 - **Framework:** MITRE ATT&CK - **Tactics:** Collection (Mobile) - **Matrix:** Mobile - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1409/ ## Activity timeline T1409 first appeared in tracked threats on 2026-04-21 and was most recently reported on 2026-09-28. The busiest month was 2026-07 with 5 reports, and 15 of the 15 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1409 Stored Application Data is catalogued by MITRE ATT&CK under the Collection (Mobile) tactic in the Mobile matrix. Threadlinqs maps 15 of 2623 tracked threats (0.6%) to it; by severity that is 3 critical, 10 high, 1 medium. Threats that use T1409 most often also use [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (12 threats), [T1646 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1646) (11 threats), [T1430 Location Tracking](https://intel.threadlinqs.com/technique/T1430) (10 threats), [T1404 Exploitation for Privilege Escalation](https://intel.threadlinqs.com/technique/T1404) (9 threats), [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (9 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 1 tracked threat actor appear in the threats that use T1409; the most frequent are [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) (3). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1409. - [M1006 Use Recent OS Version](https://attack.mitre.org/mitigations/M1006/) ## Threat actors using it - [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) — 3 ## Tracked threats 15 tracked threats use T1409. - [GitHub Security Lab AI Agent Uncovers 24 Android App Vulnerabilities, Including OsmAnd Location-Tracking…](https://intel.threadlinqs.com/threat/TL-2026-2744) — medium — 2026-09-28 - [Zero-Permission Android Apps Can Chain AtlasService and olc2 to Gain Root on OnePlus/OPPO Devices via…](https://intel.threadlinqs.com/threat/TL-2026-2683) — high — 2026-09-27 - [FomoPeek iOS App Store Poisoning: Kernel Exploit Framework Steals Crypto Private Keys via Keychain Decryption](https://intel.threadlinqs.com/threat/TL-2026-2591) — critical — 2026-09-20 - [Pegasus Spyware Used to Hack Phone of Former MEP Stelios Kouloglou, PEGA Committee Member](https://intel.threadlinqs.com/threat/TL-2026-2324) — high — 2026-09-04 - [Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…](https://intel.threadlinqs.com/threat/TL-2026-2316) — high — 2026-09-03 - [NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions…](https://intel.threadlinqs.com/threat/TL-2026-1748) — 2026-07-28 - [SparkKitty: Cross-Platform iOS/Android Stealer Using OCR to Harvest Crypto Wallet Seed Phrases from App…](https://intel.threadlinqs.com/threat/TL-2026-1717) — high — 2026-07-27 - [Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committee](https://intel.threadlinqs.com/threat/TL-2026-1110) — critical — 2026-07-05 - [European Parliament Member Investigating Pegasus Spyware Hacked With Pegasus (PWNYOURHOME Zero-Click Exploit…](https://intel.threadlinqs.com/threat/TL-2026-1099) — critical — 2026-07-03 - [Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…](https://intel.threadlinqs.com/threat/TL-2026-1098) — high — 2026-07-03 - [Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…](https://intel.threadlinqs.com/threat/TL-2026-0751) — high — 2026-06-10 - [NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)](https://intel.threadlinqs.com/threat/TL-2026-0728) — high — 2026-06-09 - [BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…](https://intel.threadlinqs.com/threat/TL-2026-0600) — high — 2026-05-27 - [NGate Android NFC Relay Malware Variant - Trojanized HandyPay Banking App Campaign Targeting Brazil…](https://intel.threadlinqs.com/threat/TL-2026-0407) — high — 2026-04-22 - [NGate Android Malware — HandyPay-Trojanized NFC Relay Variant Targets Brazilian Cardholders via Fake Rio de…](https://intel.threadlinqs.com/threat/TL-2026-0401) — high — 2026-04-21 ## Related CVEs CVEs referenced by the tracked threats that use T1409, most frequent first. - [CVE-2021-30860](https://intel.threadlinqs.com/cve/CVE-2021-30860) - [CVE-2016-4655](https://intel.threadlinqs.com/cve/CVE-2016-4655) - [CVE-2016-4656](https://intel.threadlinqs.com/cve/CVE-2016-4656) - [CVE-2016-4657](https://intel.threadlinqs.com/cve/CVE-2016-4657) - [CVE-2023-41061](https://intel.threadlinqs.com/cve/CVE-2023-41061) - [CVE-2023-41064](https://intel.threadlinqs.com/cve/CVE-2023-41064) - [CVE-2019-3568](https://intel.threadlinqs.com/cve/CVE-2019-3568) - [CVE-2024-43047](https://intel.threadlinqs.com/cve/CVE-2024-43047) - [CVE-2024-50302](https://intel.threadlinqs.com/cve/CVE-2024-50302) - [CVE-2024-53104](https://intel.threadlinqs.com/cve/CVE-2024-53104) - [CVE-2024-53197](https://intel.threadlinqs.com/cve/CVE-2024-53197) - [CVE-2025-31200](https://intel.threadlinqs.com/cve/CVE-2025-31200) - [CVE-2025-31201](https://intel.threadlinqs.com/cve/CVE-2025-31201) ## Detection coverage Threadlinqs maintains 22 detection rules mapped to T1409 (SPL 6, KQL 9, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only. 22 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1409 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)