# T1426 System Information Discovery > As of 2026-10-05, T1426 (System Information Discovery) appears in 38 tracked threats, first reported 2026-02-16 and most recently 2026-09-28, with linked actors including NSO Group, MoYu Group, APT37; it most often appears alongside T1646 (Exfiltration Over C2 Channel). - **Tracked threats:** 38 (5 critical, 28 high, 3 medium, 1 low) - **First seen:** 2026-02-16 - **Last seen:** 2026-09-28 - **Threat actors:** 4 - **Detection rules:** 29 (counts only; Blue tier and above) ## Key facts - **ID:** T1426 - **Framework:** MITRE ATT&CK - **Tactics:** Discovery (Mobile) - **Matrix:** Mobile - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1426/ ## Activity timeline T1426 first appeared in tracked threats on 2026-02-16 and was most recently reported on 2026-09-28. The busiest month was 2026-07 with 12 reports, and 38 of the 38 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1426 System Information Discovery is catalogued by MITRE ATT&CK under the Discovery (Mobile) tactic in the Mobile matrix. Threadlinqs maps 38 of 2623 tracked threats (1.4%) to it; by severity that is 5 critical, 28 high, 3 medium, 1 low. Threats that use T1426 most often also use [T1646 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1646) (26 threats), [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (24 threats), [T1437 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1437) (21 threats), [T1513 Screen Capture](https://intel.threadlinqs.com/technique/T1513) (20 threats), [T1541 Foreground Persistence](https://intel.threadlinqs.com/technique/T1541) (20 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 4 tracked threat actors appear in the threats that use T1426; the most frequent are [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) (3), [MoYu Group](https://intel.threadlinqs.com/actor/MoYu%20Group) (2), [APT37](https://intel.threadlinqs.com/actor/APT37) (1), [Intellexa Consortium](https://intel.threadlinqs.com/actor/Intellexa%20Consortium) (1). ## Threat actors using it - [NSO Group](https://intel.threadlinqs.com/actor/NSO%20Group) — 3 - [MoYu Group](https://intel.threadlinqs.com/actor/MoYu%20Group) — 2 - [APT37](https://intel.threadlinqs.com/actor/APT37) — 1 - [Intellexa Consortium](https://intel.threadlinqs.com/actor/Intellexa%20Consortium) — 1 ## Tracked threats The 30 most recent of 38 tracked threats that use T1426. - [RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritization](https://intel.threadlinqs.com/threat/TL-2026-2743) — high — 2026-09-28 - [FomoPeek iOS App Store Poisoning: Kernel Exploit Framework Steals Crypto Private Keys via Keychain Decryption](https://intel.threadlinqs.com/threat/TL-2026-2591) — critical — 2026-09-20 - [Mantax Otax: Indonesian Android Malware Combines Ransomware with Spyware Integration](https://intel.threadlinqs.com/threat/TL-2026-2719) — high — 2026-09-09 - [Zero-click Pixel 10 exploit chain: VPU driver mmap flaw (CVE-2026-0106) enables arbitrary kernel read/write…](https://intel.threadlinqs.com/threat/TL-2026-2418) — critical — 2026-09-09 - [Pegasus Spyware Used to Hack Phone of Former MEP Stelios Kouloglou, PEGA Committee Member](https://intel.threadlinqs.com/threat/TL-2026-2324) — high — 2026-09-04 - [Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…](https://intel.threadlinqs.com/threat/TL-2026-2316) — high — 2026-09-03 - [First Malware Built Specifically for Car Head Units (DoFun TWCore Update-Chain Abuse) Fuels BadBox Botnet](https://intel.threadlinqs.com/threat/TL-2026-2137) — high — 2026-08-25 - [JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnet](https://intel.threadlinqs.com/threat/TL-2026-2111) — high — 2026-08-22 - [Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Service](https://intel.threadlinqs.com/threat/TL-2026-1841) — high — 2026-08-03 - [Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal…](https://intel.threadlinqs.com/threat/TL-2026-1832) — high — 2026-08-03 - [Copybara Android RAT Delivered via Fake N26 Support Vishing Calls](https://intel.threadlinqs.com/threat/TL-2026-1804) — high — 2026-08-01 - [ESET H1 2026 Threat Report: Malicious AI Agent Skills Surge Fivefold to 3,000+ Entries; PromptSpy Debuts as…](https://intel.threadlinqs.com/threat/TL-2026-1798) — medium — 2026-07-31 - [Research: Android ML Malware Detectors Collapse Without Context-Stage Analysis (PRAXIS vs. Drebin, MalScan…](https://intel.threadlinqs.com/threat/TL-2026-1753) — low — 2026-07-29 - [NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions…](https://intel.threadlinqs.com/threat/TL-2026-1748) — 2026-07-28 - [SparkKitty: Cross-Platform iOS/Android Stealer Using OCR to Harvest Crypto Wallet Seed Phrases from App…](https://intel.threadlinqs.com/threat/TL-2026-1717) — high — 2026-07-27 - [Albiriox Android Banking RAT-as-a-Service and the Barcode Scanner Play Store Supply-Chain Compromise…](https://intel.threadlinqs.com/threat/TL-2026-1667) — medium — 2026-07-24 - [RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutions](https://intel.threadlinqs.com/threat/TL-2026-1478) — high — 2026-07-18 - [Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…](https://intel.threadlinqs.com/threat/TL-2026-1225) — high — 2026-07-11 - [Glitch SPY Android RAT Distributed via Fake Polish Rental App ("Tutaj Dom") Using Brokewell Loader](https://intel.threadlinqs.com/threat/TL-2026-1195) — high — 2026-07-10 - [Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committee](https://intel.threadlinqs.com/threat/TL-2026-1110) — critical — 2026-07-05 - [European Parliament Member Investigating Pegasus Spyware Hacked With Pegasus (PWNYOURHOME Zero-Click Exploit…](https://intel.threadlinqs.com/threat/TL-2026-1099) — critical — 2026-07-03 - [Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…](https://intel.threadlinqs.com/threat/TL-2026-1098) — high — 2026-07-03 - [Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Play](https://intel.threadlinqs.com/threat/TL-2026-1059) — high — 2026-07-02 - [CVE-2026-20971: Eight-Year-Old Samsung Knox PROCA/FIVE Kernel Use-After-Free in /proc/pid/integrity Handlers](https://intel.threadlinqs.com/threat/TL-2026-0925) — high — 2026-06-24 - [Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commands](https://intel.threadlinqs.com/threat/TL-2026-0826) — high — 2026-06-16 - [Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…](https://intel.threadlinqs.com/threat/TL-2026-0751) — high — 2026-06-10 - [Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…](https://intel.threadlinqs.com/threat/TL-2026-0737) — medium — 2026-06-09 - [NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)](https://intel.threadlinqs.com/threat/TL-2026-0728) — high — 2026-06-09 - [BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…](https://intel.threadlinqs.com/threat/TL-2026-0600) — high — 2026-05-27 - [OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and…](https://intel.threadlinqs.com/threat/TL-2026-0598) — critical — 2026-05-27 ## Related CVEs CVEs referenced by the tracked threats that use T1426, most frequent first. - [CVE-2021-30860](https://intel.threadlinqs.com/cve/CVE-2021-30860) - [CVE-2016-4655](https://intel.threadlinqs.com/cve/CVE-2016-4655) - [CVE-2016-4656](https://intel.threadlinqs.com/cve/CVE-2016-4656) - [CVE-2016-4657](https://intel.threadlinqs.com/cve/CVE-2016-4657) - [CVE-2023-41061](https://intel.threadlinqs.com/cve/CVE-2023-41061) - [CVE-2023-41064](https://intel.threadlinqs.com/cve/CVE-2023-41064) - [CVE-2019-3568](https://intel.threadlinqs.com/cve/CVE-2019-3568) - [CVE-2024-43047](https://intel.threadlinqs.com/cve/CVE-2024-43047) - [CVE-2024-50302](https://intel.threadlinqs.com/cve/CVE-2024-50302) - [CVE-2024-53104](https://intel.threadlinqs.com/cve/CVE-2024-53104) - [CVE-2024-53197](https://intel.threadlinqs.com/cve/CVE-2024-53197) - [CVE-2025-31200](https://intel.threadlinqs.com/cve/CVE-2025-31200) - [CVE-2025-31201](https://intel.threadlinqs.com/cve/CVE-2025-31201) - [CVE-2025-54957](https://intel.threadlinqs.com/cve/CVE-2025-54957) - [CVE-2026-20971](https://intel.threadlinqs.com/cve/CVE-2026-20971) ## Detection coverage Threadlinqs maintains 29 detection rules mapped to T1426 (SPL 6, KQL 9, Sigma 14). Rule content is available to Blue tier accounts and above; this page shows counts only. 29 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1426 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)