S0485 Mandrake

malwareMobile

platformsAndroid

also known asMandrake · oxide · briar · ricinus · darkmatter

Mandrake is a sophisticated Android espionage platform that has been active in the wild since at least 2016. Mandrake is very actively maintained, with sophisticated features and attacks that are executed with surgical precision. Mandrake has gone undetected for several years by providing legitimate, ad-free applications with social media and real reviews to back the apps. The malware is only activated when the operators issue a specific command.

01

techniques used (25)

ATT&CK techniques this enables or maps to.

02

source

Where this definition is published.

view on ATT&CK
scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan