{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1582","id":"T1582","name":"SMS Control","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1582","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"5a42266f195f72f33ed5c779a41de1c84bbdeb94193b86ec0199e04395fc2164","description":"Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware, or various external effects.\n\nThis can be accomplished by requesting the `RECEIVE_SMS` or `SEND_SMS` permissions depending on what the malware is attempting to do. If the app is set as the default SMS handler on the device, the `SMS_DELIVER` broadcast intent can be registered, which allows the app to write to the SMS content provider. The content provider directly modifies the messaging database on the device, which could allow malicious applications with this ability to insert, modify, or delete arbitrary messages on the device.(Citation: SMS KitKat)(Citation: Android SmsProvider)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1582","external_id":"T1582"},{"source_name":"Android SmsProvider","description":"Google. (n.d.). SmsProvider.java. Retrieved September 11, 2020.","url":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/7e7c274/src/com/android/providers/telephony/SmsProvider.java"},{"source_name":"SMS KitKat","description":"S.Main, D. Braun. (2013, October 14).  Getting Your SMS Apps Ready for KitKat. Retrieved September 11, 2020.","url":"https://android-developers.googleblog.com/2013/10/getting-your-sms-apps-ready-for-kitkat.html"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-16.html","external_id":"APP-16"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-41.html","external_id":"CEL-41"}],"platforms":["Android"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0114","name":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Declared or granted permissions of a mobile application.","collection_focus":"Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":{"label":"Inspect the owned Android lab application","language":"shell","source_id":"android_state","content":"adb shell dumpsys package test.example.lab","note":"Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream."},"required_fields":["package","permission","declared","granted"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."}],"detection":{"key":"mobile/T1582","id":"T1582","name":"SMS Control","domain":"mobile","platforms":["Android"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1582","technique_page":"techniques/mobile/T1582/","page":"detections/mobile/T1582/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0599","name":"Detection of SMS Control","url":"https://attack.mitre.org/detectionstrategies/DET0599","stix_id":"x-mitre-detection-strategy--142329a9-ff29-4bc2-af36-7294afc5fee4","relationship_id":"relationship--15059ed8-f2d1-4e51-8b65-048fd53edf44","description":"","analytics":[{"id":"AN1645","name":"Analytic 1645","guidance":"The defender correlates SMS-relevant permission state or default SMS handler role with subsequent unauthorized SMS send, receive interception, message database modification, deletion, or concealment behavior by an application outside expected messaging workflows. The analytic prioritizes Android-observable control-plane effects: SEND_SMS or RECEIVE_SMS capability, default SMS handler change or exercise of SMS_DELIVER semantics, direct interaction with the SMS content provider or messaging database, and SMS activity occurring from background or locked-device state without recent user interaction.","url":"https://attack.mitre.org/detectionstrategies/DET0599#AN1645","platforms":["Android"],"tuning":[{"field":"TimeWindow","description":"Correlation window between permission or role change, SMS control activity, message-store modification, and any follow-on network communication"},{"field":"AllowedAppList","description":"Apps legitimately expected to send or manage SMS, such as default messaging apps, carrier tools, device migration apps, or approved enterprise communications apps"},{"field":"AllowedDefaultSMSHandlers","description":"Approved packages allowed to become the default SMS handler on managed devices"},{"field":"AllowedDestinationList","description":"Approved network destinations associated with legitimate messaging synchronization or carrier workflows"},{"field":"ForegroundStateRequired","description":"Whether SMS send or message modification should occur only during active user-driven workflows"},{"field":"MessageModificationThreshold","description":"Number of insert, update, or delete operations against SMS store within a short interval required before alerting"},{"field":"SMSSendRateThreshold","description":"Maximum expected SMS send frequency for legitimate app behavior"},{"field":"HighRiskNumberPatterns","description":"Environment-specific list of premium-rate, adversary-known, or non-business SMS destination patterns"}],"log_sources":[{"component_id":"DC0114","component":"Application Permission","name":"android:MDMLog","channel":"Managed app granted SEND_SMS or RECEIVE_SMS permission, or app role/policy indicates SMS-capable behavior inconsistent with approved enterprise function before SMS control activity","platforms":["Android"],"analytic_id":"AN1645","source_url":"https://attack.mitre.org/detectionstrategies/DET0599#AN1645","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0114/"},{"component_id":"DC0114","component":"Application Permission","name":"android:MDMLog","channel":"Default SMS handler changes to non-baselined application or managed app unexpectedly becomes or remains device default SMS app during SMS control phase","platforms":["Android"],"analytic_id":"AN1645","source_url":"https://attack.mitre.org/detectionstrategies/DET0599#AN1645","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0114/"},{"component_id":"DC0021","component":"OS API Execution","name":"MobileEDR:telemetry","channel":"Application invokes SMS send, intercept, delete, or provider-write behavior, including handling SMS_DELIVER or interacting with SMS content provider during unauthorized message-control phase","platforms":["Android"],"analytic_id":"AN1645","source_url":"https://attack.mitre.org/detectionstrategies/DET0599#AN1645","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0061","component":"File Modification","name":"MobileEDR:telemetry","channel":"Application inserts, updates, deletes, hides, or marks message records in SMS store or messaging database immediately after SMS receive or send event","platforms":["Android"],"analytic_id":"AN1645","source_url":"https://attack.mitre.org/detectionstrategies/DET0599#AN1645","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]}]}],"telemetry_references":[{"id":"DC0114","name":"Application Permission","tag":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0292","name":"AndroRAT","url":"https://attack.mitre.org/software/S0292","kind":"malware","description":"[AndroRAT](https://attack.mitre.org/software/S0292) can send SMS messages.(Citation: forcepoint_bitter) ","relationship_id":"relationship--185764e3-b559-4a65-818e-1cad4db6d105","references":[{"source_name":"forcepoint_bitter","description":"Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved March 1, 2024.","url":"https://web.archive.org/web/20220706125432/https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]},{"id":"S0301","name":"Dendroid","url":"https://attack.mitre.org/software/S0301","kind":"malware","description":"[Dendroid](https://attack.mitre.org/software/S0301) can send and block SMS messages.(Citation: Lookout-Dendroid)","relationship_id":"relationship--82555171-8b78-40f3-84d9-058359ae808a","references":[{"source_name":"Lookout-Dendroid","description":"Marc Rogers. (2014, March 6). Dendroid malware can take over your camera, record audio, and sneak into Google Play. Retrieved December 22, 2016.","url":"https://blog.lookout.com/blog/2014/03/06/dendroid/"}]},{"id":"S0328","name":"Stealth Mango","url":"https://attack.mitre.org/software/S0328","kind":"malware","description":"[Stealth Mango](https://attack.mitre.org/software/S0328) deletes incoming SMS messages from specified numbers, including those that contain particular strings.(Citation: Lookout-StealthMango)","relationship_id":"relationship--52ad5145-3b04-4cc8-bed8-4a14501afe25","references":[{"source_name":"Lookout-StealthMango","description":"Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/lookout-stealth-mango-srr-us.pdf"}]},{"id":"S0411","name":"Rotexy","url":"https://attack.mitre.org/software/S0411","kind":"malware","description":"[Rotexy](https://attack.mitre.org/software/S0411) can automatically reply to SMS messages, and optionally delete them.(Citation: securelist rotexy 2018)","relationship_id":"relationship--d09abcd8-49bf-4d0f-8b17-0db7ada10ec2","references":[{"source_name":"securelist rotexy 2018","description":"T. Shishkova, L. Pikman. (2018, November 22).  The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.","url":"https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/"}]},{"id":"S0422","name":"Anubis","url":"https://attack.mitre.org/software/S0422","kind":"malware","description":"[Anubis](https://attack.mitre.org/software/S0422) can send, receive, and delete SMS messages.(Citation: Cofense Anubis)","relationship_id":"relationship--5b87bb01-9587-42bd-aa6b-30158ca8f55f","references":[{"source_name":"Cofense Anubis","description":"M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024.","url":"https://web.archive.org/web/20231222134431/https://cofense.com/blog/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/"}]},{"id":"S0423","name":"Ginp","url":"https://attack.mitre.org/software/S0423","kind":"malware","description":"[Ginp](https://attack.mitre.org/software/S0423) can send SMS messages.(Citation: ThreatFabric Ginp)","relationship_id":"relationship--eb1eeb37-37a8-47b6-aff8-9703735a4d93","references":[{"source_name":"ThreatFabric Ginp","description":"ThreatFabric. (2019, November). Ginp - A malware patchwork borrowing from Anubis. Retrieved April 8, 2020.","url":"https://www.threatfabric.com/blogs/ginp_a_malware_patchwork_borrowing_from_anubis.html"}]},{"id":"S0425","name":"Corona Updates","url":"https://attack.mitre.org/software/S0425","kind":"malware","description":"[Corona Updates](https://attack.mitre.org/software/S0425) can send SMS messages.(Citation: TrendMicro Coronavirus Updates)","relationship_id":"relationship--0a610208-06af-425f-a9af-cd0899261e33","references":[{"source_name":"TrendMicro Coronavirus Updates","description":"T. Bao, J. Lu. (2020, April 14).  Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/coronavirus-update-app-leads-to-project-spy-android-and-ios-spyware/"}]},{"id":"S0427","name":"TrickMo","url":"https://attack.mitre.org/software/S0427","kind":"malware","description":"[TrickMo](https://attack.mitre.org/software/S0427) can delete SMS messages.(Citation: SecurityIntelligence TrickMo)","relationship_id":"relationship--c4e73a6c-d523-4f3c-bcb6-200f63867fb4","references":[{"source_name":"SecurityIntelligence TrickMo","description":"P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.","url":"https://securityintelligence.com/posts/trickbot-pushing-a-2fa-bypass-app-to-bank-customers-in-germany/"}]},{"id":"S0480","name":"Cerberus","url":"https://attack.mitre.org/software/S0480","kind":"malware","description":"[Cerberus](https://attack.mitre.org/software/S0480) can send SMS messages from a device.(Citation: Threat Fabric Cerberus)","relationship_id":"relationship--78fc4506-5c80-4638-8f51-44a2e28f7aaf","references":[{"source_name":"Threat Fabric Cerberus","description":"Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.","url":"https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html"}]},{"id":"S0485","name":"Mandrake","url":"https://attack.mitre.org/software/S0485","kind":"malware","description":"[Mandrake](https://attack.mitre.org/software/S0485) can block, forward, hide, and send SMS messages.(Citation: Bitdefender Mandrake)","relationship_id":"relationship--734fa2bf-17af-4e54-8d83-4cf9759e4ba9","references":[{"source_name":"Bitdefender Mandrake","description":"R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf"}]},{"id":"S0489","name":"WolfRAT","url":"https://attack.mitre.org/software/S0489","kind":"malware","description":"[WolfRAT](https://attack.mitre.org/software/S0489) can delete and send SMS messages.(Citation: Talos-WolfRAT)","relationship_id":"relationship--66ba3094-7c14-41b9-b7c1-814d026156b9","references":[{"source_name":"Talos-WolfRAT","description":"W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19).  The wolf is back... . Retrieved July 20, 2020.","url":"https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html"}]},{"id":"S0505","name":"Desert Scorpion","url":"https://attack.mitre.org/software/S0505","kind":"malware","description":"[Desert Scorpion](https://attack.mitre.org/software/S0505) can send SMS messages.(Citation: Lookout Desert Scorpion)","relationship_id":"relationship--c659256c-82e3-4f4c-ac70-3d2400cf6695","references":[{"source_name":"Lookout Desert Scorpion","description":"A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.","url":"https://blog.lookout.com/desert-scorpion-google-play"}]},{"id":"S0509","name":"FakeSpy","url":"https://attack.mitre.org/software/S0509","kind":"malware","description":"[FakeSpy](https://attack.mitre.org/software/S0509) can send SMS messages.(Citation: Cybereason FakeSpy)","relationship_id":"relationship--b477afcb-7449-4fae-b4aa-c512c22d7500","references":[{"source_name":"Cybereason FakeSpy","description":"O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.","url":"https://www.cybereason.com/blog/fakespy-masquerades-as-postal-service-apps-around-the-world"}]},{"id":"S0522","name":"Exobot","url":"https://attack.mitre.org/software/S0522","kind":"malware","description":"[Exobot](https://attack.mitre.org/software/S0522) can forward SMS messages.(Citation: Threat Fabric Exobot)","relationship_id":"relationship--4ad83f33-c64a-4ad6-ab6f-0548c9dde257","references":[{"source_name":"Threat Fabric Exobot","description":"Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.","url":"https://www.threatfabric.com/blogs/exobot_android_banking_trojan_on_the_rise.html"}]},{"id":"S0536","name":"GPlayed","url":"https://attack.mitre.org/software/S0536","kind":"malware","description":"[GPlayed](https://attack.mitre.org/software/S0536) can send SMS messages.(Citation: Talos GPlayed)","relationship_id":"relationship--2e913583-123a-47af-8872-98fc12ab4a6a","references":[{"source_name":"Talos GPlayed","description":"V. Ventura. (2018, October 11).  GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.","url":"https://blog.talosintelligence.com/2018/10/gplayedtrojan.html"}]},{"id":"S0539","name":"Red Alert 2.0","url":"https://attack.mitre.org/software/S0539","kind":"malware","description":"[Red Alert 2.0](https://attack.mitre.org/software/S0539) can send SMS messages.(Citation: Sophos Red Alert 2.0)","relationship_id":"relationship--38f37e3f-1d4b-4f04-b176-1cae6d22931e","references":[{"source_name":"Sophos Red Alert 2.0","description":"J. Chandraiah. (2018, July 23). Red Alert 2.0: Android Trojan targets security-seekers. Retrieved December 14, 2020.","url":"https://news.sophos.com/en-us/2018/07/23/red-alert-2-0-android-trojan-targets-security-seekers/"}]},{"id":"S0540","name":"Asacub","url":"https://attack.mitre.org/software/S0540","kind":"malware","description":"[Asacub](https://attack.mitre.org/software/S0540) can send SMS messages from compromised devices.(Citation: Securelist Asacub) ","relationship_id":"relationship--a808c887-b2b8-4b05-9cab-47c918e48d48","references":[{"source_name":"Securelist Asacub","description":"T. Shishkova. (2018, August 28).  The rise of mobile banker Asacub. Retrieved December 14, 2020.","url":"https://securelist.com/the-rise-of-mobile-banker-asacub/87591/"}]},{"id":"S0545","name":"TERRACOTTA","url":"https://attack.mitre.org/software/S0545","kind":"malware","description":"[TERRACOTTA](https://attack.mitre.org/software/S0545) can send SMS messages.(Citation: WhiteOps TERRACOTTA)","relationship_id":"relationship--f87bb2d2-e7fd-44ce-b537-e7e01086731c","references":[{"source_name":"WhiteOps TERRACOTTA","description":"Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.","url":"https://www.whiteops.com/blog/terracotta-android-malware-a-technical-study"}]},{"id":"S0549","name":"SilkBean","url":"https://attack.mitre.org/software/S0549","kind":"malware","description":" [SilkBean](https://attack.mitre.org/software/S0549) can send SMS messages.(Citation: Lookout Uyghur Campaign) ","relationship_id":"relationship--2f8b5252-551c-4a0d-8e72-8da4050757f3","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0551","name":"GoldenEagle","url":"https://attack.mitre.org/software/S0551","kind":"malware","description":"[GoldenEagle](https://attack.mitre.org/software/S0551) has sent messages to an attacker-controlled number.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--7a8e1611-1a7e-45a0-b518-6efd744fce4f","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0558","name":"Tiktok Pro","url":"https://attack.mitre.org/software/S0558","kind":"malware","description":"[Tiktok Pro](https://attack.mitre.org/software/S0558) can send SMS messages.(Citation: Zscaler TikTok Spyware)","relationship_id":"relationship--6d659130-545b-4917-891c-6c1b7d54ed07","references":[{"source_name":"Zscaler TikTok Spyware","description":"S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.","url":"https://www.zscaler.com/blogs/security-research/tiktok-spyware"}]},{"id":"S0655","name":"BusyGasper","url":"https://attack.mitre.org/software/S0655","kind":"malware","description":"[BusyGasper](https://attack.mitre.org/software/S0655) can send an SMS message after the device boots, messages containing logs, messages to adversary-specified numbers with custom content, and can delete all SMS messages on the device.(Citation: SecureList BusyGasper)","relationship_id":"relationship--c8559423-10b0-4d5e-9057-65cbfd7ee1c0","references":[{"source_name":"SecureList BusyGasper","description":"Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.","url":"https://securelist.com/busygasper-the-unfriendly-spy/87627/"}]},{"id":"S1054","name":"Drinik","url":"https://attack.mitre.org/software/S1054","kind":"malware","description":"[Drinik](https://attack.mitre.org/software/S1054) can steal incoming SMS messages and send SMS messages from compromised devices. (Citation: cyble_drinik_1022)","relationship_id":"relationship--08a43019-d393-451f-a23c-2dfa17ec40b2","references":[{"source_name":"cyble_drinik_1022","description":"Cyble. (2022, October 27). Drinik Malware Returns With Advanced Capabilities Targeting Indian Taxpayers. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20221114031945/https://blog.cyble.com/2022/10/27/drinik-malware-returns-with-advanced-capabilities-targeting-indian-taxpayers/"}]},{"id":"S1055","name":"SharkBot","url":"https://attack.mitre.org/software/S1055","kind":"malware","description":"[SharkBot](https://attack.mitre.org/software/S1055) can hide and send SMS messages. [SharkBot](https://attack.mitre.org/software/S1055) can also change which application is the device’s default SMS handler.(Citation: nccgroup_sharkbot_0322)","relationship_id":"relationship--9f83d618-a42d-4797-b9fe-030affdbd13f","references":[{"source_name":"nccgroup_sharkbot_0322","description":"RIFT: Research and Intelligence Fusion Team. (2022, March 3). SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store. Retrieved January 18, 2023.","url":"https://research.nccgroup.com/2022/03/03/sharkbot-a-new-generation-android-banking-trojan-being-distributed-on-google-play-store/"}]},{"id":"S1062","name":"S.O.V.A.","url":"https://attack.mitre.org/software/S1062","kind":"malware","description":"[S.O.V.A.](https://attack.mitre.org/software/S1062) can send SMS messages.(Citation: threatfabric_sova_0921)","relationship_id":"relationship--cc345ae4-0d60-4f21-98b3-596c15118745","references":[{"source_name":"threatfabric_sova_0921","description":"ThreatFabric. (2021, September 9). S.O.V.A. - A new Android Banking trojan with fowl intentions. Retrieved February 6, 2023.","url":"https://www.threatfabric.com/blogs/sova-new-trojan-with-fowl-intentions.html"}]},{"id":"S1067","name":"FluBot","url":"https://attack.mitre.org/software/S1067","kind":"malware","description":"[FluBot](https://attack.mitre.org/software/S1067) can send SMS phishing messages to other contacts on an infected device.(Citation: proofpoint_flubot_0421)(Citation: bitdefender_flubot_0524)","relationship_id":"relationship--0f116d99-9ce4-4790-aeda-ad9199d8bf7b","references":[{"source_name":"proofpoint_flubot_0421","description":"Crista Giering, F. Naves, Andrew Conway, Adam McNeil . (2021, April 27). FluBot Android Malware Spreading Rapidly Through Europe, May Hit U.S. Soon. Retrieved February 28, 2023.","url":"https://www.proofpoint.com/us/blog/threat-insight/flubot-android-malware-spreading-rapidly-through-europe-may-hit-us-soon"},{"source_name":"bitdefender_flubot_0524","description":"Filip TRUȚĂ, Răzvan GOSA, Adrian Mihai GOZOB. (2022, May 24). New FluBot Campaign Sweeps through Europe Targeting Android and iOS Users Alike. Retrieved February 28, 2023.","url":"https://www.bitdefender.com/blog/labs/new-flubot-campaign-sweeps-through-europe-targeting-android-and-ios-users-alike/"}]},{"id":"S1069","name":"TangleBot","url":"https://attack.mitre.org/software/S1069","kind":"malware","description":"[TangleBot](https://attack.mitre.org/software/S1069) can send text messages.(Citation: cloudmark_tanglebot_0921)","relationship_id":"relationship--b19082d2-c151-45dd-8844-82335fbe3ed9","references":[{"source_name":"cloudmark_tanglebot_0921","description":"Felipe Naves, Andrew Conway, W. Stuart Jones, Adam McNeil . (2021, September 23). TangleBot: New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures. Retrieved February 28, 2023.","url":"https://www.cloudmark.com/en/blog/malware/tanglebot-new-advanced-sms-malware-targets-mobile-users-across-us-and-canada-covid-19"}]},{"id":"S1092","name":"Escobar","url":"https://attack.mitre.org/software/S1092","kind":"malware","description":"[Escobar](https://attack.mitre.org/software/S1092) can modify, send, and delete SMS messages.(Citation: Bleeipng Computer Escobar)","relationship_id":"relationship--cdf06664-903e-499b-86b4-b7bcce3c0740","references":[{"source_name":"Bleeipng Computer Escobar","description":"B. Toulas. (2022, March 12). Android malware Escobar steals your Google Authenticator MFA codes. Retrieved September 28, 2023.","url":"https://www.bleepingcomputer.com/news/security/android-malware-escobar-steals-your-google-authenticator-mfa-codes/"}]},{"id":"S1095","name":"AhRat","url":"https://attack.mitre.org/software/S1095","kind":"malware","description":"[AhRat](https://attack.mitre.org/software/S1095) can send SMS messages.(Citation: welivesecurity_ahrat_0523)","relationship_id":"relationship--dbdaa604-b94c-43d1-b8cc-e8e2bbc3fdce","references":[{"source_name":"welivesecurity_ahrat_0523","description":"Lukas Stefanko. (2023, May 23). Android app breaking bad: From legitimate screen recording to file exfiltration within a year. Retrieved December 18, 2023.","url":"https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) has sent and deleted SMS messages.(Citation: Threatfabric LightSpy 2023)(Citation: Threatfabric LightSpy 2024)(Citation: LinkedIn Dmitry LightSpy 2025)","relationship_id":"relationship--e682fd05-a55e-447c-9de1-788cf061ba70","references":[{"source_name":"LinkedIn Dmitry LightSpy 2025","description":"Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.","url":"https://www.linkedin.com/pulse/coordinated-kill-switch-lightspys-ios-destructive-plugin-bestuzhev-zhoye/"},{"source_name":"Threatfabric LightSpy 2023","description":"ThreatFabric. (2023, October 2). LightSpy mAPT Mobile Payment System Attack. Retrieved January 17, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack"},{"source_name":"Threatfabric LightSpy 2024","description":"ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-implant-for-ios"}]},{"id":"S1195","name":"SpyC23","url":"https://attack.mitre.org/software/S1195","kind":"malware","description":"[SpyC23](https://attack.mitre.org/software/S1195) can send SMS messages.(Citation: welivesecurity_apt-c-23)","relationship_id":"relationship--60da837d-a635-4533-b96a-db2689cc4771","references":[{"source_name":"welivesecurity_apt-c-23","description":"Stefanko, L. (2020, September 30). APT‑C‑23 group evolves its Android spyware. Retrieved March 4, 2024.","url":"https://web.archive.org/web/20201123042131/www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/"}]},{"id":"S1231","name":"GodFather","url":"https://attack.mitre.org/software/S1231","kind":"malware","description":"[GodFather](https://attack.mitre.org/software/S1231) has requested for the `SEND_SMS` permission to send SMS messages.(Citation: MerkleScience_Godfather_April2023)","relationship_id":"relationship--d7d6f1dd-9ed2-48a5-8c81-6dc09181d3fd","references":[{"source_name":"MerkleScience_Godfather_April2023","description":"Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025.","url":"https://www.merklescience.com/blog/the-godfather-android-malware-threat-under-the-lens"}]},{"id":"S9004","name":"Crocodilus","url":"https://attack.mitre.org/software/S9004","kind":"malware","description":"[Crocodilus](https://attack.mitre.org/software/S9004) has the ability to send SMS messages to a specified number, to a list of numbers, or to all contacts. Additionally, [Crocodilus](https://attack.mitre.org/software/S9004) has the ability to perform Unstructured Supplementary Service Data (USSD) requests.(Citation: ThreatFabric_Crocodilus_March2025)","relationship_id":"relationship--174b139b-83ff-4cdc-889f-6e5936731741","references":[{"source_name":"ThreatFabric_Crocodilus_March2025","description":"ThreatFabric. (2025, March 28). Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices. Retrieved November 24, 2025.","url":"https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices"}]}],"actors":[],"mitigations":[{"id":"M1011","name":"User Guidance","url":"https://attack.mitre.org/mitigations/M1011","kind":"course-of-action","description":"Users should be encouraged to be very careful with what applications they grant SMS access to. Further, users should not change their default SMS handler to applications they do not recognize.(Citation: SMS KitKat)","relationship_id":"relationship--a67c5611-00bc-4e1a-a1be-2512a2bcf072","references":[{"source_name":"SMS KitKat","description":"S.Main, D. Braun. (2013, October 14).  Getting Your SMS Apps Ready for KitKat. Retrieved September 11, 2020.","url":"https://android-developers.googleblog.com/2013/10/getting-your-sms-apps-ready-for-kitkat.html"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1582":"/ttp-simulation/techniques/mobile/T1582/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1582","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}}]}}