Activity timeline
T1422 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-08 with 4 reports, and 12 of the 12 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1422 System Network Configuration Discovery is catalogued by MITRE ATT&CK under the Discovery (Mobile) tactic in the Mobile matrix. Threadlinqs maps 12 of 2623 tracked threats (0.5%) to it; by severity that is 10 high, 1 medium.
Threats that use T1422 most often also use T1426 System Information Discovery (11 threats), T1429 Audio Capture (8 threats), T1541 Foreground Persistence (8 threats), T1660 Phishing (8 threats), T1418 Software Discovery (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
3 tracked threat actors appear in the threats that use T1422; the most frequent are MoYu Group (2), APT37 (1), NSO Group (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1422.
Threat actors using it
Tracked threats
12 tracked threats use T1422.
- Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…high
- First Malware Built Specifically for Car Head Units (DoFun TWCore Update-Chain Abuse) Fuels BadBox Botnethigh
- JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnethigh
- Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Servicehigh
- Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh
- NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions…
- Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…medium
- BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…high
- TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL for Covert C2 Targeting Banking and Crypto Users…high
- ScarCruft (APT37) BirdCall Android Variant — Multiplatform Supply-Chain Attack via sqgame[.]com[.]cn…high
- ResidentBat — Belarusian KGB Android Spyware at Internet Scale (ADB Sideloading, Custom HTTPS C2, Journalist…high
- SURXRAT Android RAT — LLM Module Downloads from Hugging Face, MaaS via Telegram, ArsinkRAT Evolutionhigh
Detection coverage
Threadlinqs maintains 6 detection rules mapped to T1422 (SPL 1, KQL 2, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1422.001 Internet Connection Discovery — 1 tracked threat
- T1422.002 Wi-Fi Discovery — 1 tracked threat