Skip to content
Install MCP

Threat actor

MSAB

Last fetched

MSAB is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

MSAB is a Swedish forensic technology company. Its software, XRY, which can decrypt passwords and recover deleted data, was reportedly used by Hong Kong police in 2020 to access pro-democracy activist Joshua Wong's phone in under an hour. Leaked documents in 2021 showed that Myanmar's military junta used MSAB's technology to extract data from phones, including deleted content. In the U.S, the San Diego Police Department employs MSAB's XRY software to extract data from mobile devices in investigations. It's also used by the FBI and U.S. Customs and Border Protection (CPB), among other government agencies. MSAB developed tools for CPB to gather information from vehicles at border crossings by extracting data from car infotainment systems. These systems store a wealth of information, including call logs, text messages, GPS locations, and paired device data. Its reseller in Hong Kong is S-Tech, which also sells surveillance tools from Oxygen Forensics and BlackBag (acquired by Cellebrite in 2020.)

Techniques by tactic

No ATT&CK techniques are recorded for MSAB in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to MSAB today — this states the absence of a published link, not that MSAB has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from MSAB into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.