Analytical Mapping
ZeroDayRAT Through the MITRE ATT&CK Mobile Lens
Reported behaviours mapped to ATT&CK Mobile tactic categories to organise detection and mitigation work. Technique categories are named rather than asserted by ID, because IDs must be verified against the current knowledge base before publication.
Quick Answer
How does ZeroDayRAT map to MITRE ATT&CK Mobile?
Reported ZeroDayRAT behaviours align with familiar ATT&CK Mobile tactics: discovery (device and application profiling), collection (location, SMS, notifications, screen, audio, video, input, clipboard), command and control (operator tasking) and exfiltration (transfer to operator infrastructure). This mapping is an analytical interpretation intended to organise detection work, not an attribution claim.
Disclaimer
Join Our Community
ZeroDayRAT Intelligence on Telegram
Get real-time mobile spyware alerts, threat briefings, and defensive guidance.
ZeroDayRAT — conceptual ATT&CK Mobile mapping
| Reported behaviour | ATT&CK Mobile category | Evidence level | Detection opportunity | Mitigation |
|---|---|---|---|---|
| Device and OS profiling | System Information Discovery (Discovery tactic) | Reported | Unexpected device-info reads by non-system apps; MDM inventory drift. | Restrict app sources; maintain inventory and compliance baselines. |
| Installed application enumeration | Software Discovery (Discovery tactic) | Reported | Package-query behaviour; usage-stats access grants. | Managed app catalogues; permission policy. |
| Location collection and history | Location Tracking (Collection tactic) | Reported | Background location grants; location-usage indicators. | Limit to foreground use; disable background location. |
| SMS content access | SMS Messages access (Collection tactic) | Reported | SMS permissions on non-messaging apps; default SMS app changes. | Remove SMS-based MFA; audit SMS permissions. |
| Notification interception | Access to notifications / Input Capture family | Reported | Notification-listener services enabled unexpectedly. | Audit notification access; hide sensitive previews. |
| Screen monitoring | Screen Capture (Collection tactic) | Reported | Screen-capture or media-projection permission grants. | Policy restriction; MTD detection of risky grants. |
| Input / keylogging | Input Capture (Collection tactic) | Reported | Accessibility enrolment; third-party keyboards. | Restrict accessibility services and keyboards. |
| Camera and microphone access | Video Capture / Audio Capture (Collection tactic) | Advertised | OS in-use indicators; permission-usage history. | Least-privilege permissions; user awareness of indicators. |
| Clipboard access | Clipboard Data (Collection tactic) | Reported | Clipboard-access notices; user reports of altered pasted values. | Verify addresses out-of-band; hardware wallet confirmation. |
| Remote command execution and tasking | Command and Control tactic | Reported | Beaconing intervals; rare-domain resolution; persistent sessions. | DNS security; egress monitoring; device-admin review. |
| Data transfer to operator infrastructure | Exfiltration tactic | Reported | Upload asymmetry; transfers on unmetered networks. | Network telemetry; conditional access on non-compliant devices. |
| Credential and account targeting | Credentials from Password Store / Input Capture | Advertised | Identity-provider anomalies; unexpected MFA prompts. | Phishing-resistant MFA; session and token revocation. |
Evidence & Sources
ZeroDayRAT reporting summarised here draws on public cybersecurity research and CERT-style reporting from February 2026 onward. We distinguish independently observed technical evidence from media reporting, operator claims and our own analytical assessment. Primary sources are linked so readers can verify claims directly.
- MITRE ATT&CK Mobile knowledge base — tactic and technique definitions (verify current IDs before publication).
- iVerify — reported ZeroDayRAT behaviour descriptions (February 2026).
- ThaiCERT — advisory summary of reported functionality (February 2026).
- Android and Apple platform security documentation — detection and mitigation behaviour.
Source verification policy: see Editorial Policy
Support This Publisher
Related Intelligence