Activity timeline
T1544 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-08 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1544 Ingress Tool Transfer is catalogued by MITRE ATT&CK under the Command and Control (Mobile) tactic in the Mobile matrix. Threadlinqs maps 10 of 2961 tracked threats (0.3%) to it; by severity that is 10 high.
Threats that use T1544 most often also use T1406 Obfuscated Files or Information (8 threats), T1407 Download New Code at Runtime (8 threats), T1426 System Information Discovery (7 threats), T1437 Application Layer Protocol (6 threats), T1655 Masquerading (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1544; the most frequent are MoYu Group (2).
Threat actors using it
Tracked threats
10 tracked threats use T1544.
- Hirudo Android Banking Trojan Replaces Indonesian Banking Apps with Patched Copies and Relays Play Integrity…high
- Malicious PDF Reader on Google Play (10,000+ installs) Delivers Anatsa (TeaBot) Banking Trojanhigh
- Midnight Mimosa: Low-cost MediaTek Android phones ship with firmware-level ad-fraud and residential proxy…high
- RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritizationhigh
- StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTokhigh
- First Malware Built Specifically for Car Head Units (DoFun TWCore Update-Chain Abuse) Fuels BadBox Botnethigh
- JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnethigh
- Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal…high
- Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…high
- Popa Botnet — Android TV Box Residential-Proxy Malware (Vo1d/Mzmess Plugin) Linked to NetNut / Alarum…high
Detection coverage
Threadlinqs maintains 26 detection rules mapped to T1544 (SPL 7, KQL 9, Sigma 10). Rule content is available to Blue tier accounts and above; this page shows counts only.