T1628.001 Suppress Application Icon

Activity timeline

T1628.001 first appeared in tracked threats on 2026-02-16 and was most recently reported on 2026-10-17. The busiest month was 2026-02 with 3 reports, and 11 of the 11 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1628.001 Suppress Application Icon is catalogued by MITRE ATT&CK under the Defense Evasion (Mobile) tactic in the Mobile matrix, as a sub-technique of T1628 Hide Artifacts. Threadlinqs maps 11 of 3302 tracked threats (0.3%) to it; by severity that is 1 critical, 9 high, 1 medium.

Threats that use T1628.001 most often also use T1513 Screen Capture (9 threats), T1541 Foreground Persistence (9 threats), T1417.002 GUI Input Capture (8 threats), T1418 Software Discovery (8 threats), T1646 Exfiltration Over C2 Channel (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

1 tracked threat actor appear in the threats that use T1628.001; the most frequent are GoldFactory (1).

Mitigations

MITRE ATT&CK lists 2 mitigations for T1628.001.

• M1006 Use Recent OS Version
• M1011 User Guidance

Threat actors using it

• GoldFactory 1

Tracked threats

11 tracked threats use T1628.001.

• YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwordshigh2026-10-17
• YuanKong Android RAT: Accessibility-Driven Remote Control, Overlay Credential Theft and Wireless Debugging…high2026-10-17
• Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)high2026-09-11
• ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countrieshigh2026-08-24
• Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh2026-08-01
• "BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platformhigh2026-07-22
• Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…medium2026-06-09
• OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and…critical2026-05-27
• ResidentBat — Belarusian KGB Android Spyware at Internet Scale (ADB Sideloading, Custom HTTPS C2, Journalist…high2026-02-25
• SURXRAT Android RAT — LLM Module Downloads from Hugging Face, MaaS via Telegram, ArsinkRAT Evolutionhigh2026-02-24
• ZeroDayRAT Commercial Mobile Spyware — Telegram-Sold Cross-Platform Android/iOS Surveillance, Live…high2026-02-16

Detection coverage

Threadlinqs maintains 25 detection rules mapped to T1628.001 (SPL 10, KQL 5, Sigma 10). Rule content is available to Blue tier accounts and above; this page shows counts only.

Parent technique

T1628 Hide Artifacts — 21 tracked threats at the technique level.