Mobile malware deletes data for two reasons: to cause damage, and to erase the evidence of fraud or espionage it has just committed. MITRE ATT&CK for Mobile tracks this as T1662 Data Destruction, an Impact technique. ATT&CK v20 lists the platform as Android only, and describes adversaries uninstalling non-system packages and removing specific files to interrupt availability and hide activity. One recorded procedure is LightSpy (S1185), software ATT&CK lists for Android, iOS, macOS and Windows; the procedure cites ThreatFabric's analysis of the LightSpy iOS implant. The Enterprise equivalent is T1485 Data Destruction. This page covers the public cases, the controls that limit damage, MITRE's detection analytic and recovery. For the wider matrix see the MITRE ATT&CK for Mobile Guide.
Key takeaways
- Destruction often follows fraud. Cleafy reports that BRATA performs a factory reset right after an unauthorised transfer attempt, to delay discovery and erase traces.
- Device admin is the lever on Android. BRATA's factory reset needs the device admin permission, which it requests at installation; ATT&CK's only mitigation is training users to recognise these prompts (M1011).
- Corporate data should not live only on the phone. If managed apps sync to backed-up services, a wiped phone is an inconvenience, not a data loss.
- Destruction destroys evidence too. Acquire forensic data as soon as compromise is suspected, before the malware or a well-meaning user resets the device.
- iOS is not listed but not immune. ThreatFabric describes destructive plugins in the LightSpy iOS implant, running after a compromise through flaws Apple fixed in iOS 13.5 and 13.6.
Procedure examples in ATT&CK for Mobile
| Software | Platform | What the sources record |
|---|---|---|
| BRATA (S1094) | Android | ATT&CK: can perform a factory reset. Cleafy (January 2022): the reset acts as a kill switch after a fraud completes, or when the app detects it is running in a virtual analysis environment; it targeted banking customers in the UK, Poland, Italy and Latin America |
| SameCoin (S9030) | Android | ATT&CK: fills selected files with zeros and then deletes them. Check Point: deployed on 24 February 2024 as an app impersonating a security update from Israel's National Cyber Directorate |
| RatMilad (S1241) | Android | ATT&CK: has deleted files on the device |
| LightSpy (S1185) | Android, iOS, macOS, Windows (software listing); cited source covers iOS | ATT&CK: deleted media and messenger-related files, and removed messaging applications. ThreatFabric (October 2024): destructive plugins delete media, SMS, contacts, browser history and Wi-Fi profiles, and one can stop the device from booting |
Related Mobile Impact techniques: Mobile T1471 Data Encrypted for Impact and Mobile T1640 Account Access Removal. For the desktop and server picture see the Wiper Malware Guide; for banking malware, the Android Banking Trojans Guide.
Android and iOS compared
| Aspect | Android | iOS and iPadOS |
|---|---|---|
| ATT&CK v20 platform listing | Listed | Not listed for T1662; LightSpy procedure recorded |
| How an app gets destructive power | Device admin permission (factory reset), shared storage access, or elevated privileges after rooting | Only after a full device compromise through exploits; App Store rules confine apps to their own container |
| Main prevention | Block sideloading, control device admin grants, keep Play Protect on, patch | Patch, Lockdown Mode for high-risk users |
| Recovery source | Managed backup or cloud sync of work data, re-enrolment | Managed backup or cloud sync of work data, re-enrolment |
The iOS row on app confinement draws on Apple's rule that apps may not read or write data outside their designated container (App Store Review Guideline 2.5.2).
Controls that limit damage
- Stop the install: block unknown-source installs on managed Android devices and keep Play Protect on; BRATA and SameCoin both arrived as apps outside normal trust. See the Android Enterprise Security Guide.
- Control device admin and accessibility grants: on managed devices, restrict which apps may become device administrators; train users that an unexpected device admin prompt is a stop sign. See the Mobile App Permissions guide.
- Keep work data off the device only: use managed apps that sync to backed-up enterprise services, so a wiped device loses nothing that matters. See the M1053 Data Backup guide.
- Patch: LightSpy's destructive plugins ran only after initial access through flaws since fixed; current OS versions remove that path. See the iOS and iPadOS Enterprise Security Guide.
- Protect high-risk users: Lockdown Mode on iOS and Advanced Protection on Android reduce the exploit surface that implants like LightSpy depend on. See the Apple Lockdown Mode Guide.
Detection and measurement
ATT&CK v20 detection strategy DET0671 has a single Android analytic (AN1769). It treats management state queries as periodic observations, not real-time events, and depends on application vetting or instrumented telemetry for process and file detail.
| Signal (from MITRE's analytic) | Default threshold | Data source |
|---|---|---|
| Bulk package uninstall by a process that is not the MDM agent or OTA update service | More than 5 packages in 300 seconds | Dynamic analysis or runtime trace |
| File deletions under app data, user data or shared storage by a process that is not the MDM agent | More than 100 deletions in 300 seconds | Forensic artefacts or filesystem trace |
| A shell process started with package removal or file deletion arguments by an unexpected parent | Any, outside the MDM agent list | Managed device telemetry |
MITRE notes that an MDM wipe uses a different API, so the analytic does not confuse an administrator's remote wipe with malware. In practice the simplest signals are in MDM: a device that checks in after an unplanned factory reset, a sudden loss of managed apps, or a device that stops checking in right after a banking or payment alert. See the Mobile Device Management Security Guide.
Metrics:
- Percentage of managed Android devices that block unknown-source installs.
- Apps holding device admin rights outside the approved list.
- Unplanned factory resets or re-enrolments per month, and how many were investigated.
- Percentage of work data held in managed apps backed by enterprise storage.
- Time from a reported lost or destroyed device to restored user productivity.
Rolling out the controls
- Find exposure: list managed Android devices that allow sideloading and apps holding device admin rights.
- Move data: confirm that mail, files and line-of-business data sync to enterprise services with backup.
- Restrict: block unknown-source installs, pilot first with one group, and move any sideloaded business apps into managed distribution.
- Detect: alert on unplanned resets and re-enrolments from MDM, and add MTD where available.
- Prepare recovery: document how a user gets a working device back, including re-enrolment and credential re-registration.
Responding to destruction
- Preserve: if the device still works, acquire data before anything else; see the Mobile Forensics Guide.
- Check for fraud: with BRATA-style behaviour, the wipe is the end of the attack; contact the bank and review account activity at once.
- Contain identity: revoke the device's sessions, certificates and app tokens.
- Restore: rebuild or replace the device, re-enrol it and restore work data from enterprise services.
- Scope: search MDM inventory for the same malicious package on other devices.
Where identity fits
A wiped or reset device can lose its enrolled credentials: passkeys bound to the device, authenticator apps and MDM certificates. Plan recovery so a user can re-register a phishing-resistant credential without falling back to weak help desk resets, and revoke the old device's tokens so a later restore from a compromised backup cannot reuse them. See the MFA backup codes and recovery codes guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| ATT&CK for Mobile | M1011 User Guidance | The mitigation ATT&CK maps to T1662 |
| ATT&CK Enterprise | T1485 Data Destruction | Desktop and server equivalent |
| NIST SP 800-53 Rev 5 | CP-9 System Backup, CM-11 User-installed Software, AC-19 Access Control for Mobile Devices | Recovery, install control, device conditions |
| NIST CSF 2.0 | PR.DS-11, PR.PS-05, RS.MI-01 | Backups, preventing unauthorised software, containment |
Common failure patterns
- Work data only on the handset: photos, notes or files that never sync are lost for good.
- Treating a reset as a fault: an unexplained factory reset is closed as a support ticket instead of investigated.
- Device admin grants nobody reviews: any app holding the right can reset the device.
- Recovery that depends on the lost phone: the only MFA factor was on the wiped device, so the user is locked out or reset through a weak process.
Practitioner checklist
- Block unknown-source installs on managed Android devices.
- Review apps holding device admin rights.
- Keep work data in managed apps synced to backed-up enterprise services.
- Alert on unplanned factory resets and re-enrolments.
- Preserve evidence before wiping a suspect device.
- Keep OS versions current and protect high-risk users with Lockdown Mode or Advanced Protection.
- Document a credential recovery path that does not depend on the lost device.
Standards and references
- MITRE ATT&CK: T1662 Data Destruction (Mobile)
- Cleafy Labs: How BRATA is monitoring your bank account
- Check Point Research: Hamas-affiliated threat actor WIRTE expands to disruptive activity
- ThreatFabric: LightSpy, implant for iOS
- Google: Google Play Protect client protections
- Apple: App Store Review Guidelines
- Apple: About Lockdown Mode
Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide, Data Integrity Protection Against Destructive Attacks Guide, Wiper Attack Response Playbook, Mobile Malware Guide.