diff --git a/pkgs/by-name/mv/mvt/package.nix b/pkgs/by-name/mv/mvt/package.nix
new file mode 100644
index 000000000000..21659483fa3c
--- /dev/null
+++ b/pkgs/by-name/mv/mvt/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "mvt";
+  pyproject = true;
+  version = "2.5.4";
+
+  src = fetchFromGitHub {
+    owner = "mvt-project";
+    repo = "mvt";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-xDUjyvOsiweRqibTe7V8I/ABeaahCoR/d5w23qixp9A";
+  };
+
+  build-system = with python3.pkgs; [ setuptools ];
+
+  dependencies = with python3.pkgs; [
+    adb-shell
+    appdirs
+    click
+    cryptography
+    libusb1
+    iosbackup
+    packaging
+    pyahocorasick
+    pyyaml
+    requests
+    rich
+    simplejson
+    tld
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+    pytest-mock
+    stix2
+  ];
+
+  meta = {
+    description = "Tool to facilitate the consensual forensic analysis of Android and iOS devices";
+    homepage = "https://docs.mvt.re/en/latest/";
+    # https://github.com/mvt-project/mvt/blob/main/LICENSE
+    license = lib.licenses.unfree;
+    changelog = "https://github.com/mvt-project/mvt/releases/tag/v${version}";
+    maintainers = with lib.maintainers; [ PapayaJackal ];
+  };
+}
diff --git a/pkgs/development/python-modules/iosbackup/default.nix b/pkgs/development/python-modules/iosbackup/default.nix
new file mode 100644
index 000000000000..41904c36336c
--- /dev/null
+++ b/pkgs/development/python-modules/iosbackup/default.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  nskeyedunarchiver,
+  pycrypto,
+}:
+
+buildPythonPackage rec {
+  pname = "iosbackup";
+  version = "0.9.925";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "iOSbackup";
+    hash = "sha256-M1Rakknls/qq3x7ngv5r3823D64N77oazuM2pl+T0co=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    pycrypto
+    nskeyedunarchiver
+  ];
+
+  pythonImportsCheck = [ "iOSbackup" ];
+
+  meta = {
+    description = "Reads and extracts files from password-encrypted iOS backups";
+    homepage = "https://github.com/avibrazil/iOSbackup";
+    license = lib.licenses.lgpl2Only;
+    maintainers = with lib.maintainers; [ PapayaJackal ];
+  };
+}
diff --git a/pkgs/development/python-modules/medallion/default.nix b/pkgs/development/python-modules/medallion/default.nix
new file mode 100644
index 000000000000..04972dc1eb06
--- /dev/null
+++ b/pkgs/development/python-modules/medallion/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  setuptools,
+  flask,
+  flask-httpauth,
+  pytz,
+  six,
+  pymongo,
+}:
+
+buildPythonPackage rec {
+  pname = "medallion";
+  version = "3.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "oasis-open";
+    repo = "cti-taxii-server";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-+fWifWi/XR6MSOLhWXn2CFpItVdkOpzQItlrZkjapAk=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    flask
+    flask-httpauth
+    pymongo
+    pytz
+    six
+  ];
+
+  pythonImportsCheck = [ "medallion" ];
+
+  meta = with lib; {
+    description = "Minimal implementation of a TAXII 2.1 Server in Python";
+    homepage = "https://medallion.readthedocs.io/en/latest/";
+    changelog = "https://github.com/oasis-open/cti-taxii-server/blob/v${version}/CHANGES.txt";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ PapayaJackal ];
+  };
+}
diff --git a/pkgs/development/python-modules/nskeyedunarchiver/default.nix b/pkgs/development/python-modules/nskeyedunarchiver/default.nix
new file mode 100644
index 000000000000..ed4e5ac35f5c
--- /dev/null
+++ b/pkgs/development/python-modules/nskeyedunarchiver/default.nix
@@ -0,0 +1,29 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  lib,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "nskeyedunarchiver";
+  version = "1.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "NSKeyedUnArchiver";
+    hash = "sha256-OZWPGH8ggYYKxeg6CGyft6ZM9Yx/43z7YylzXlQcTVg=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "NSKeyedUnArchiver" ];
+
+  meta = {
+    description = "Unserializes plist data into a usable Python dict";
+    homepage = "https://github.com/avibrazil/NSKeyedUnArchiver";
+    license = lib.licenses.bsdOriginal;
+    maintainers = with lib.maintainers; [ PapayaJackal ];
+  };
+}
diff --git a/pkgs/development/python-modules/stix2/default.nix b/pkgs/development/python-modules/stix2/default.nix
new file mode 100644
index 000000000000..26622eea45b5
--- /dev/null
+++ b/pkgs/development/python-modules/stix2/default.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  setuptools,
+  haversine,
+  medallion,
+  pytz,
+  rapidfuzz,
+  requests,
+  simplejson,
+  stix2-patterns,
+  taxii2-client,
+}:
+
+buildPythonPackage rec {
+  pname = "stix2";
+  version = "3.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "oasis-open";
+    repo = "cti-python-stix2";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-1bILZUZgPOWmFWRu4p/fmgi4QPEE1lFQH9mxoWd/saI=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    pytz
+    requests
+    simplejson
+    stix2-patterns
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    haversine
+    medallion
+    rapidfuzz
+    taxii2-client
+  ];
+
+  disabledTests = [
+    # flaky tests
+    "test_graph_equivalence_with_filesystem_source"
+    "test_graph_similarity_with_filesystem_source"
+    "test_object_similarity_prop_scores"
+  ];
+
+  pythonImportsCheck = [ "stix2" ];
+
+  meta = with lib; {
+    description = "Produce and consume STIX 2 JSON content";
+    homepage = "https://stix2.readthedocs.io/en/latest/";
+    changelog = "https://github.com/oasis-open/cti-python-stix2/blob/v${version}/CHANGELOG";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ PapayaJackal ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e9698dd70f2e..40bc928f4361 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6237,6 +6237,8 @@ self: super: with self; {
 
   iopath = callPackage ../development/python-modules/iopath { };
 
+  iosbackup = callPackage ../development/python-modules/iosbackup { };
+
   iotawattpy = callPackage ../development/python-modules/iotawattpy { };
 
   iottycloud = callPackage ../development/python-modules/iottycloud { };
@@ -7847,6 +7849,8 @@ self: super: with self; {
 
   mechanize = callPackage ../development/python-modules/mechanize { };
 
+  medallion = callPackage ../development/python-modules/medallion { };
+
   mediafile = callPackage ../development/python-modules/mediafile { };
 
   mediafire-dl = callPackage ../development/python-modules/mediafire-dl { };
@@ -9133,6 +9137,8 @@ self: super: with self; {
 
   nsapi = callPackage ../development/python-modules/nsapi { };
 
+  nskeyedunarchiver = callPackage ../development/python-modules/nskeyedunarchiver { };
+
   ntc-templates = callPackage ../development/python-modules/ntc-templates { };
 
   ntplib = callPackage ../development/python-modules/ntplib { };
@@ -15153,6 +15159,8 @@ self: super: with self; {
 
   stim = callPackage ../development/python-modules/stim { };
 
+  stix2 = callPackage ../development/python-modules/stix2 { };
+
   stix2-patterns = callPackage ../development/python-modules/stix2-patterns { };
 
   stix2-validator = callPackage ../development/python-modules/stix2-validator { };