Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/T1409
MITRE ATT&CK Technique

T1409: Stored Application Data

ShareXLinkedInRedditHN

Adversaries may try to access and collect application data resident on the device. Adversaries often target popular applications, such as Facebook, WeChat, and Gmail.(Citation: SWB Exodus March 2019) Due to mobile OS sandboxing, this technique is only possible in three scenarios: * An application stores files in unprotected external storage * An application stores files in its internal storage directory with insecure permissions (e.g. 777) * The adversary gains root permissions on the device

Tactics
Collection
Platforms
Android, iOS

▪Mitigations (1)

M1006Use Recent OS Version

New mobile operating system versions bring not only patches against discovered vulnerabilities but also often bring security architecture improvements that provide resilience against potential vulnerabilities or weaknesses that have not yet been discovered. They may also bring improvements that block use of observed adversary techniques.

▪Used by groups (1)

G0034Sandworm Team

▪Software using this technique (30)

S0289Pegasus for iOSmalwareS0295RCSAndroidmalwareS0311YiSpectermalwareS0316Pegasus for AndroidmalwareS0324SpyDealermalwareS0327SkygofreemalwareS0329TangelomalwareS0399PallasmalwareS0405ExodusmalwareS0408FlexiSpytoolS0485MandrakemalwareS0505Desert ScorpionmalwareS0509FakeSpymalwareS0529CarbonStealmalwareS0550DoubleAgentmalwareS0551GoldenEaglemalwareS0577FrozenCellmalwareS0655BusyGaspermalwareS1062S.O.V.A.malwareS1067FluBotmalwareS1077HornbillmalwareS1079BOULDSPYmalwareS1082SunbirdmalwareS1092EscobarmalwareS1093FlyTrapmalwareS1103FlixOnlinemalwareS1128HilalRATmalwareS1185LightSpymalwareS1243DCHSpymalwareS9006VajraSpymalware

▪Reference

T1409on MITRE ATT&CK

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.