T1629.003 Disable or Modify Tools

Activity timeline

T1629.003 first appeared in tracked threats on 2026-07-11 and was most recently reported on 2026-11-02. The busiest month was 2026-10 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.

How adversaries use it

T1629.003 Disable or Modify Tools is catalogued by MITRE ATT&CK under the Defense Evasion (Mobile) tactic in the Mobile matrix, as a sub-technique of T1629 Impair Defenses. Threadlinqs maps 10 of 3541 tracked threats (0.3%) to it; by severity that is 10 high.

Threats that use T1629.003 most often also use T1418 Software Discovery (9 threats), T1655.001 Match Legitimate Name or Location (8 threats), T1513 Screen Capture (7 threats), T1646 Exfiltration Over C2 Channel (7 threats), T1660 Phishing (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

Tracked threats

10 tracked threats use T1629.003.

• XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Googlehigh2026-11-02
• Hirudo Android Banking RAT Replaces Legitimate Banking Apps With Patched Copies to Bypass Security Checkshigh2026-10-22
• Hirudo Android Banking RAT Replaces Legitimate Banking Apps via Fake In-App Updateshigh2026-10-22
• Manic: Android Malware Blending Banking Trojan and Spyware Capabilities (Ukraine-focused)high2026-10-15
• Hirudo Android Banking Trojan Replaces Indonesian Banking Apps with Patched Copies and Relays Play Integrity…high2026-10-14
• Midnight Mimosa: Low-cost MediaTek Android phones ship with firmware-level ad-fraud and residential proxy…high2026-10-09
• Zero-Permission Android Apps Can Chain AtlasService and olc2 to Gain Root on OnePlus/OPPO Devices via…high2026-09-27
• RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV Apphigh2026-09-23
• Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads…high2026-09-01
• Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…high2026-07-11

Detection coverage

Threadlinqs maintains 26 detection rules mapped to T1629.003 (SPL 10, KQL 10, Sigma 6). Rule content unlocks with TL Creds on a free account; this page shows counts only.

Parent technique

T1629 Impair Defenses — 16 tracked threats at the technique level.