1. Home
  2. Techniques
  3. Mobile
  4. Location Tracking

Location Tracking

An adversary could use a malicious or exploited application to surreptitiously track the device's physical location through use of standard operating system APIs.

ID: T1430
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
ⓘ
Tactics: Collection, Discovery
ⓘ
Platforms: Android, iOS
ⓘ
MTC ID: APP-24
Version: 1.0
Created: 25 October 2017
Last Modified: 15 October 2019

Procedure Examples

ID Name Description
S0309 Adups

Adups transmitted location information.[1]
S0304 Android/Chuli.A

Android/Chuli.A stole geo-location data.[2]
S0292 AndroRAT

AndroRAT tracks the device location.[3]
S0422 Anubis

Anubis can retrieve the device’s GPS location.[4]
S0655 BusyGasper

BusyGasper can collect the device’s location information based on cellular network or GPS coordinates.[5]
S0529 CarbonSteal

CarbonSteal can access the device’s location and track the device over time.[6]
S0480 Cerberus

Cerberus can collect the device’s location.[7]
S0323 Charger

Charger checks the local settings of the device and does not run its malicious logic if the device is located in Ukraine, Russia, or Belarus.[8]
S0555 CHEMISTGAMES

CHEMISTGAMES has collected the device’s location.[9]
S0425 Corona Updates

Corona Updates can track the device’s location.[10]
S0505 Desert Scorpion

Desert Scorpion can track the device’s location.[11]
S0507 eSurv

eSurv can track the device’s location.[12]
S0405 Exodus

Exodus Two can extract the GPS coordinates of the device.[13]
S0182 FinFisher

FinFisher tracks the latitude and longitude coordinates of the infected device.[14]
S0408 FlexiSpy

FlexiSpy can track the device's location.[15]
S0577 FrozenCell

FrozenCell has used an online cell tower geolocation service to track targets.[16]
S0535 Golden Cup

Golden Cup can track the device’s location.[17]
S0551 GoldenEagle

GoldenEagle has tracked location.[6]
S0421 GolfSpy

GolfSpy can track the device’s location.[18]
S0536 GPlayed

GPlayed can request the device’s location.[19]
S0544 HenBox

HenBox can track the device’s location.[20]
S0463 INSOMNIA

INSOMNIA can track the device’s location.[21]
S0485 Mandrake

Mandrake can collect the device’s location.[22]
S0407 Monokle

Monokle can track the device's location.[23]
S0399 Pallas

Pallas tracks the latitude and longitude coordinates of the infected device.[14]
S0289 Pegasus for iOS

Pegasus for iOS update and sends the location of the phone.[24]
S0291 PJApps

PJApps has the capability to collect and leak the victim's location.[3]
S0295 RCSAndroid

RCSAndroid can record location.[25]
S0549 SilkBean

SilkBean has access to the device’s location.[6]
S0327 Skygofree

Skygofree can track the device's location.[26]
S0324 SpyDealer

SpyDealer harvests location data from victims.[27]
S0305 SpyNote RAT

SpyNote RAT collects the device's location.[28]
S0328 Stealth Mango

Stealth Mango can perform GPS location tracking as well as capturing coordinates as when an SMS message or call is received.[29]
S0329 Tangelo

Tangelo contains functionality to gather GPS coordinates.[29]
S0558 Tiktok Pro

Tiktok Pro can track the device’s location.[30]
S0418 ViceLeaker

ViceLeaker can collect location information, including GPS coordinates.[31][32]
S0506 ViperRAT

ViperRAT can track the device’s location.[33]
G0112 Windshift

Windshift has included location tracking capabilities in the malicious apps deployed as part of Operation BULL and Operation ROCK.[34]
S0314 X-Agent for Android

X-Agent for Android was believed to have been used to obtain locational data of Ukrainian artillery forces.[35]

Mitigations

ID Mitigation Description
M1005 Application Vetting

On Android, applications must request the ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION permission to access the device's physical location. Extra scrutiny could be given to applications that request these permissions. On iOS, calls to the relevant APIs could be detected during the vetting process.

Detection

On both Android (6.0 and up) and iOS, the user can view which applications have permission to access device location through the device settings screen, and the user can choose to revoke the permissions.

References

  1. Matt Apuzzo and Michael S. Schmidt. (2016, November 15). Secret Back Door in Some U.S. Phones Sent Data to China, Analysts Say. Retrieved February 6, 2017.
  2. Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.
  3. Lookout. (2016, May 25). 5 active mobile threats spoofing enterprise apps. Retrieved December 19, 2016.
  4. M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved April 8, 2020.
  5. Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.
  6. A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
  7. Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.
  8. Oren Koriat and Andrey Polkovnichenko. (2017, January 24). Charger Malware Calls and Raises the Risk on Google Play. Retrieved January 24, 2017.
  9. B. Leonard, N. Mehta. (2019, November 21). The Secret Life of Sandworms. Retrieved December 31, 2020.
  10. T. Bao, J. Lu. (2020, April 14). Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.
  11. A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.
  12. A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.
  13. Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved September 3, 2019.
  14. Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
  15. Actis B. (2017, April 22). FlexSpy Application Analysis. Retrieved September 4, 2019.
  16. Michael Flossman. (2017, October 5). FrozenCell: Multi-platform surveillance campaign against Palestinians. Retrieved November 11, 2020.
  17. R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.
  18. E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.
  1. V. Ventura. (2018, October 11). GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.
  2. A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.
  3. I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.
  4. R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.
  5. Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
  6. Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.
  7. Veo Zhang. (2015, July 21). Hacking Team RCSAndroid Spying Tool Listens to Calls; Roots Devices to Get In. Retrieved December 22, 2016.
  8. Nikita Buchka and Alexey Firsh. (2018, January 16). Skygofree: Following in the footsteps of HackingTeam. Retrieved September 24, 2018.
  9. Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.
  10. Shivang Desai. (2017, January 23). SpyNote RAT posing as Netflix app. Retrieved January 26, 2017.
  11. Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.
  12. S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.
  13. GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.
  14. L. Arsene, C. Ochinca. (2018, August 20). Triout – Spyware Framework for Android with Extensive Surveillance Capabilities. Retrieved January 21, 2020.
  15. M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.
  16. The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.
  17. CrowdStrike Global Intelligence Team. (2016). Use of Fancy Bear Android Malware in Tracking of Ukrainian FIeld Artillery Units. Retrieved February 6, 2017.