T1406: Obfuscated Files or Information

216.73.217.172

T1406: Obfuscated Files or Information

View on MITRE ATT&CK The MITRE Corporation · Published 25/10/2017 16:48 · Modified 27/03/2026 01:41

Essential information

MITRE technique ID: T1406
Confidence: 100/100
Revoked: No
Published: 25/10/2017 16:48
Modified: 27/03/2026 01:41
Author / Source: The MITRE Corporation

Aliases

T1406

Platforms

android iOS

Description

Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Portions of files can also be encoded to hide the plaintext strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.(Citation: Microsoft MalLockerB)

Kill chain phases

Kill chain	Phase
mitre-mobile-attack	defense-evasion

Marking (TLP)

External references

Related entities

DONOT uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Sandworm uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
PROMETHIUM uses StrongPity

The MITRE Corporation Confidence 100

[PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Windshift uses Bahamut

The MITRE Corporation Confidence 100

[Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation:…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Star Blizzard uses SEABORGIUMCallisto Group

The MITRE Corporation Confidence 100

[Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia that has been active since at least 2019. [Star Blizzard](https://attack.mitre.org/groups/G1033) campaigns align closely with Russian state…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Anatsa uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Evilnum uses

The MITRE Corporation Confidence 100

[Evilnum](https://attack.mitre.org/groups/G0120) is a financially motivated threat group that has been active since at least 2018.(Citation: ESET EvilNum July 2020)

First seen 01/01/1970 · Last seen 16/11/5138 ·