# T1628.001 Suppress Application Icon > As of 2026-10-28, T1628.001 (Suppress Application Icon) appears in 11 tracked threats, first reported 2026-02-16 and most recently 2026-10-17, with linked actors including GoldFactory; it most often appears alongside T1513 (Screen Capture). - **Tracked threats:** 11 (1 critical, 9 high, 1 medium) - **First seen:** 2026-02-16 - **Last seen:** 2026-10-17 - **Threat actors:** 1 - **Detection rules:** 25 (counts only; Blue tier and above) ## Key facts - **ID:** T1628.001 - **Framework:** MITRE ATT&CK - **Tactics:** Defense Evasion (Mobile) - **Matrix:** Mobile - **Parent:** T1628 - **Data as of:** 2026-10-28 - **MITRE:** https://attack.mitre.org/techniques/T1628/001/ ## Activity timeline T1628.001 first appeared in tracked threats on 2026-02-16 and was most recently reported on 2026-10-17. The busiest month was 2026-02 with 3 reports, and 11 of the 11 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1628.001 Suppress Application Icon is catalogued by MITRE ATT&CK under the Defense Evasion (Mobile) tactic in the Mobile matrix, as a sub-technique of [T1628 Hide Artifacts](https://intel.threadlinqs.com/technique/T1628). Threadlinqs maps 11 of 3302 tracked threats (0.3%) to it; by severity that is 1 critical, 9 high, 1 medium. Threats that use T1628.001 most often also use [T1513 Screen Capture](https://intel.threadlinqs.com/technique/T1513) (9 threats), [T1541 Foreground Persistence](https://intel.threadlinqs.com/technique/T1541) (9 threats), [T1417.002 GUI Input Capture](https://intel.threadlinqs.com/technique/T1417.002) (8 threats), [T1418 Software Discovery](https://intel.threadlinqs.com/technique/T1418) (8 threats), [T1646 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1646) (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 1 tracked threat actor appear in the threats that use T1628.001; the most frequent are [GoldFactory](https://intel.threadlinqs.com/actor/GoldFactory) (1). ## Mitigations MITRE ATT&CK lists 2 mitigations for T1628.001. - [M1006 Use Recent OS Version](https://attack.mitre.org/mitigations/M1006/) - [M1011 User Guidance](https://attack.mitre.org/mitigations/M1011/) ## Threat actors using it - [GoldFactory](https://intel.threadlinqs.com/actor/GoldFactory) — 1 ## Tracked threats 11 tracked threats use T1628.001. - [YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords](https://intel.threadlinqs.com/threat/TL-2026-3822) — high — 2026-10-17 - [YuanKong Android RAT: Accessibility-Driven Remote Control, Overlay Credential Theft and Wireless Debugging…](https://intel.threadlinqs.com/threat/TL-2026-3810) — high — 2026-10-17 - [Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)](https://intel.threadlinqs.com/threat/TL-2026-2444) — high — 2026-09-11 - [ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countries](https://intel.threadlinqs.com/threat/TL-2026-2128) — high — 2026-08-24 - [Copybara Android RAT Delivered via Fake N26 Support Vishing Calls](https://intel.threadlinqs.com/threat/TL-2026-1804) — high — 2026-08-01 - ["BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platform](https://intel.threadlinqs.com/threat/TL-2026-1636) — high — 2026-07-22 - [Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…](https://intel.threadlinqs.com/threat/TL-2026-0737) — medium — 2026-06-09 - [OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and…](https://intel.threadlinqs.com/threat/TL-2026-0598) — critical — 2026-05-27 - [ResidentBat — Belarusian KGB Android Spyware at Internet Scale (ADB Sideloading, Custom HTTPS C2, Journalist…](https://intel.threadlinqs.com/threat/TL-2026-0143) — high — 2026-02-25 - [SURXRAT Android RAT — LLM Module Downloads from Hugging Face, MaaS via Telegram, ArsinkRAT Evolution](https://intel.threadlinqs.com/threat/TL-2026-0142) — high — 2026-02-24 - [ZeroDayRAT Commercial Mobile Spyware — Telegram-Sold Cross-Platform Android/iOS Surveillance, Live…](https://intel.threadlinqs.com/threat/TL-2026-0116) — high — 2026-02-16 ## Detection coverage Threadlinqs maintains 25 detection rules mapped to T1628.001 (SPL 10, KQL 5, Sigma 10). Rule content is available to Blue tier accounts and above; this page shows counts only. 25 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1628 Hide Artifacts](https://intel.threadlinqs.com/technique/T1628) — 21 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1628.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)