# T1544 Ingress Tool Transfer > As of 2026-10-16, T1544 (Ingress Tool Transfer) appears in 10 tracked threats, first reported 2026-06-18 and most recently 2026-10-14, with linked actors including MoYu Group; it most often appears alongside T1406 (Obfuscated Files or Information). - **Tracked threats:** 10 (10 high) - **First seen:** 2026-06-18 - **Last seen:** 2026-10-14 - **Threat actors:** 1 - **Detection rules:** 26 (counts only; Blue tier and above) ## Key facts - **ID:** T1544 - **Framework:** MITRE ATT&CK - **Tactics:** Command and Control (Mobile) - **Matrix:** Mobile - **Data as of:** 2026-10-16 - **MITRE:** https://attack.mitre.org/techniques/T1544/ ## Activity timeline T1544 first appeared in tracked threats on 2026-06-18 and was most recently reported on 2026-10-14. The busiest month was 2026-08 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1544 Ingress Tool Transfer is catalogued by MITRE ATT&CK under the Command and Control (Mobile) tactic in the Mobile matrix. Threadlinqs maps 10 of 2961 tracked threats (0.3%) to it; by severity that is 10 high. Threats that use T1544 most often also use [T1406 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1406) (8 threats), [T1407 Download New Code at Runtime](https://intel.threadlinqs.com/technique/T1407) (8 threats), [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (7 threats), [T1437 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1437) (6 threats), [T1655 Masquerading](https://intel.threadlinqs.com/technique/T1655) (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 1 tracked threat actor appear in the threats that use T1544; the most frequent are [MoYu Group](https://intel.threadlinqs.com/actor/MoYu%20Group) (2). ## Threat actors using it - [MoYu Group](https://intel.threadlinqs.com/actor/MoYu%20Group) — 2 ## Tracked threats 10 tracked threats use T1544. - [Hirudo Android Banking Trojan Replaces Indonesian Banking Apps with Patched Copies and Relays Play Integrity…](https://intel.threadlinqs.com/threat/TL-2026-3499) — high — 2026-10-14 - [Malicious PDF Reader on Google Play (10,000+ installs) Delivers Anatsa (TeaBot) Banking Trojan](https://intel.threadlinqs.com/threat/TL-2026-3099) — high — 2026-10-09 - [Midnight Mimosa: Low-cost MediaTek Android phones ship with firmware-level ad-fraud and residential proxy…](https://intel.threadlinqs.com/threat/TL-2026-3066) — high — 2026-10-09 - [RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritization](https://intel.threadlinqs.com/threat/TL-2026-2743) — high — 2026-09-28 - [StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTok](https://intel.threadlinqs.com/threat/TL-2026-2312) — high — 2026-09-03 - [First Malware Built Specifically for Car Head Units (DoFun TWCore Update-Chain Abuse) Fuels BadBox Botnet](https://intel.threadlinqs.com/threat/TL-2026-2137) — high — 2026-08-25 - [JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnet](https://intel.threadlinqs.com/threat/TL-2026-2111) — high — 2026-08-22 - [Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal…](https://intel.threadlinqs.com/threat/TL-2026-1832) — high — 2026-08-03 - [Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…](https://intel.threadlinqs.com/threat/TL-2026-1098) — high — 2026-07-03 - [Popa Botnet — Android TV Box Residential-Proxy Malware (Vo1d/Mzmess Plugin) Linked to NetNut / Alarum…](https://intel.threadlinqs.com/threat/TL-2026-0858) — high — 2026-06-18 ## Detection coverage Threadlinqs maintains 26 detection rules mapped to T1544 (SPL 7, KQL 9, Sigma 10). Rule content is available to Blue tier accounts and above; this page shows counts only. 26 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1544 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)