{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1616","id":"T1616","name":"Call Control","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1616","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"f064e479fbedfec4d91a1a80a187b3ce6b7bed6674ea605a02898fe4f51068ca","description":"Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.\n\nSeveral permissions may be used to programmatically control phone calls, including:\n\n* `ANSWER_PHONE_CALLS` - Allows the application to answer incoming phone calls(Citation: Android Permissions)\n* `CALL_PHONE` - Allows the application to initiate a phone call without going through the Dialer interface(Citation: Android Permissions)\n* `PROCESS_OUTGOING_CALLS` - Allows the application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether(Citation: Android Permissions)\n* `MANAGE_OWN_CALLS` - Allows a calling application which manages its own calls through the self-managed `ConnectionService` APIs(Citation: Android Permissions)\n* `BIND_TELECOM_CONNECTION_SERVICE` - Required permission when using a `ConnectionService`(Citation: Android Permissions)\n* `WRITE_CALL_LOG` - Allows an application to write to the device call log, potentially to hide malicious phone calls(Citation: Android Permissions)\n\nWhen granted some of these permissions, an application can make a phone call without opening the dialer first. However, if an application desires to simply redirect the user to the dialer with a phone number filled in, it can launch an Intent using `Intent.ACTION_DIAL`, which requires no specific permissions. This then requires the user to explicitly initiate the call or use some form of [Input Injection](https://attack.mitre.org/techniques/T1516) to programmatically initiate it.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1616","external_id":"T1616"},{"source_name":"Android Permissions","description":"Google. (2021, August 11). Manifest.permission. Retrieved September 22, 2021.","url":"https://developer.android.com/reference/android/Manifest.permission"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-41.html","external_id":"APP-41"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-42.html","external_id":"CEL-42"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-36.html","external_id":"CEL-36"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-18.html","external_id":"CEL-18"}],"platforms":["Android"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0114","name":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Declared or granted permissions of a mobile application.","collection_focus":"Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":{"label":"Inspect the owned Android lab application","language":"shell","source_id":"android_state","content":"adb shell dumpsys package test.example.lab","note":"Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream."},"required_fields":["package","permission","declared","granted"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."}],"detection":{"key":"mobile/T1616","id":"T1616","name":"Call Control","domain":"mobile","platforms":["Android"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1616","technique_page":"techniques/mobile/T1616/","page":"detections/mobile/T1616/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0703","name":"Detection of Call Control","url":"https://attack.mitre.org/detectionstrategies/DET0703","stix_id":"x-mitre-detection-strategy--0abd72c9-7d7f-4e8a-99d7-5ac2f791eb9d","relationship_id":"relationship--48c9d015-70bb-4142-8f02-c492b9a2d573","description":"","analytics":[{"id":"AN1822","name":"Analytic 1822","guidance":"For Android, detect Call Control from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Modification via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App inserts, updates, or deletes call log records via CallLog.Calls ContentProvider immediately after call-control action — call log tampering to conceal interception]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes TelecomManager.answerCall(), placeCall(), endCall(), or ConnectionService call-handling operations without corresponding user-initiated call UI interaction]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0703#AN1822","platforms":["Android"],"tuning":[{"field":"ApprovedTelecomApps","description":"Default dialer, approved VoIP apps, enterprise call manager. Derive from MDM catalog. Tightening: system dialer and MDM-pushed VoIP only."},{"field":"CallInteractionThreshold","description":"Default 10s between incoming call event and app call-answer action without user UI. Silent answer within 10s of ring without user touch is covert."}],"log_sources":[{"component_id":"DC0114","component":"Application Permission","name":"android:DevicePolicyManager","channel":"DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review","platforms":["Android"],"analytic_id":"AN1822","source_url":"https://attack.mitre.org/detectionstrategies/DET0703#AN1822","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0114/"},{"component_id":"DC0061","component":"File Modification","name":"mobile:ForensicArtifacts","channel":"Dynamic filesystem trace or acquired app-container/filesystem artifacts: App inserts, updates, or deletes call log records via CallLog.Calls ContentProvider immediately after call-control action — call log tampering to conceal interception","platforms":["Android"],"analytic_id":"AN1822","source_url":"https://attack.mitre.org/detectionstrategies/DET0703#AN1822","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0021","component":"OS API Execution","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: App invokes TelecomManager.answerCall(), placeCall(), endCall(), or ConnectionService call-handling operations without corresponding user-initiated call UI interaction","platforms":["Android"],"analytic_id":"AN1822","source_url":"https://attack.mitre.org/detectionstrategies/DET0703#AN1822","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]}]}],"telemetry_references":[{"id":"DC0114","name":"Application Permission","tag":"Application Permission","page":"telemetry/DC0114/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0292","name":"AndroRAT","url":"https://attack.mitre.org/software/S0292","kind":"malware","description":"[AndroRAT](https://attack.mitre.org/software/S0292) can make phone calls.(Citation: forcepoint_bitter) ","relationship_id":"relationship--e50c605a-0cdf-4316-bb49-2deccc69143f","references":[{"source_name":"forcepoint_bitter","description":"Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved March 1, 2024.","url":"https://web.archive.org/web/20220706125432/https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]},{"id":"S0407","name":"Monokle","url":"https://attack.mitre.org/software/S0407","kind":"malware","description":"[Monokle](https://attack.mitre.org/software/S0407) can be controlled via phone call from a set of \"control phones.\"(Citation: Lookout-Monokle)","relationship_id":"relationship--716f68ee-1e77-4254-8f67-d8f3c71db678","references":[{"source_name":"Lookout-Monokle","description":"Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.","url":"https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf"}]},{"id":"S0422","name":"Anubis","url":"https://attack.mitre.org/software/S0422","kind":"malware","description":"[Anubis](https://attack.mitre.org/software/S0422) can make phone calls.(Citation: Cofense Anubis)","relationship_id":"relationship--6935752c-e400-4dfa-863f-1d44a8f6dd50","references":[{"source_name":"Cofense Anubis","description":"M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024.","url":"https://web.archive.org/web/20231222134431/https://cofense.com/blog/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/"}]},{"id":"S0529","name":"CarbonSteal","url":"https://attack.mitre.org/software/S0529","kind":"malware","description":"[CarbonSteal](https://attack.mitre.org/software/S0529) can silently accept an incoming phone call.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--684c17bb-2075-4e1f-9fcb-17408511222d","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0655","name":"BusyGasper","url":"https://attack.mitre.org/software/S0655","kind":"malware","description":"[BusyGasper](https://attack.mitre.org/software/S0655) can open a hidden menu when a specific phone number is called from the infected device.(Citation: SecureList BusyGasper)","relationship_id":"relationship--5b670281-0054-42b4-8e54-ea01a692f5bf","references":[{"source_name":"SecureList BusyGasper","description":"Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.","url":"https://securelist.com/busygasper-the-unfriendly-spy/87627/"}]},{"id":"S1054","name":"Drinik","url":"https://attack.mitre.org/software/S1054","kind":"malware","description":"[Drinik](https://attack.mitre.org/software/S1054) can use the Android `CallScreeningService` to silently block incoming calls.(Citation: cyble_drinik_1022)","relationship_id":"relationship--4e68feca-083f-40ed-88d8-2b6a3935c949","references":[{"source_name":"cyble_drinik_1022","description":"Cyble. (2022, October 27). Drinik Malware Returns With Advanced Capabilities Targeting Indian Taxpayers. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20221114031945/https://blog.cyble.com/2022/10/27/drinik-malware-returns-with-advanced-capabilities-targeting-indian-taxpayers/"}]},{"id":"S1069","name":"TangleBot","url":"https://attack.mitre.org/software/S1069","kind":"malware","description":"[TangleBot](https://attack.mitre.org/software/S1069) can make and block phone calls.(Citation: cloudmark_tanglebot_0921)","relationship_id":"relationship--4aae6ab8-2a67-4780-a69e-b15ecff7fc5d","references":[{"source_name":"cloudmark_tanglebot_0921","description":"Felipe Naves, Andrew Conway, W. Stuart Jones, Adam McNeil . (2021, September 23). TangleBot: New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures. Retrieved February 28, 2023.","url":"https://www.cloudmark.com/en/blog/malware/tanglebot-new-advanced-sms-malware-targets-mobile-users-across-us-and-canada-covid-19"}]},{"id":"S1080","name":"Fakecalls","url":"https://attack.mitre.org/software/S1080","kind":"malware","description":"[Fakecalls](https://attack.mitre.org/software/S1080) can intercept and imitate phone conversations by breaking the connection and displaying a fake call screen. It can also make outgoing calls and spoof incoming calls.(Citation: kaspersky_fakecalls_0422)","relationship_id":"relationship--ade5c0c5-8b53-4bc5-9d81-0284be2e5fee","references":[{"source_name":"kaspersky_fakecalls_0422","description":"Igor Golovin. (2022, April 11). Fakecalls: a talking Trojan. Retrieved July 21, 2023.","url":"https://www.kaspersky.com/blog/fakecalls-banking-trojan/44072/"}]},{"id":"S1083","name":"Chameleon","url":"https://attack.mitre.org/software/S1083","kind":"malware","description":"[Chameleon](https://attack.mitre.org/software/S1083) has the ability to control calls.(Citation: ThreatFabric_Chameleon_Dec2023)","relationship_id":"relationship--1cf04fb7-17a6-4424-a3f2-93f1b33d19cd","references":[{"source_name":"ThreatFabric_Chameleon_Dec2023","description":"ThreatFabric. (2023, December 21). Android Banking Trojan Chameleon can now bypass any Biometric Authentication. Retrieved July 7, 2025.","url":"https://www.threatfabric.com/blogs/android-banking-trojan-chameleon-is-back-in-action"}]},{"id":"S1092","name":"Escobar","url":"https://attack.mitre.org/software/S1092","kind":"malware","description":"[Escobar](https://attack.mitre.org/software/S1092) can initiate phone calls.(Citation: Bleeipng Computer Escobar)","relationship_id":"relationship--3a282967-0536-474d-8831-30cd60b818a9","references":[{"source_name":"Bleeipng Computer Escobar","description":"B. Toulas. (2022, March 12). Android malware Escobar steals your Google Authenticator MFA codes. Retrieved September 28, 2023.","url":"https://www.bleepingcomputer.com/news/security/android-malware-escobar-steals-your-google-authenticator-mfa-codes/"}]},{"id":"S1094","name":"BRATA","url":"https://attack.mitre.org/software/S1094","kind":"malware","description":"[BRATA](https://attack.mitre.org/software/S1094) can hide incoming calls by setting ring volume to 0 and showing a blank screen overlay.(Citation: mcafee_brata_0421)","relationship_id":"relationship--80eb5ebc-ae6f-461e-8e78-a18702249343","references":[{"source_name":"mcafee_brata_0421","description":"Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/brata-keeps-sneaking-into-google-play-now-targeting-usa-and-spain/"}]},{"id":"S1195","name":"SpyC23","url":"https://attack.mitre.org/software/S1195","kind":"malware","description":"[SpyC23](https://attack.mitre.org/software/S1195) can make phone calls.(Citation: welivesecurity_apt-c-23)(Citation: SentinelLabs AridViper 2023)","relationship_id":"relationship--06869cb8-7384-4d85-aa0a-78256133c88d","references":[{"source_name":"SentinelLabs AridViper 2023","description":"Delamotte, A. (2023, November 6). Arid Viper | APT’s Nest of SpyC23 Malware Continues to Target Android Devices. Retrieved December 2, 2024.","url":"https://www.sentinelone.com/labs/arid-viper-apts-nest-of-spyc23-malware-continues-to-target-android-devices/"},{"source_name":"welivesecurity_apt-c-23","description":"Stefanko, L. (2020, September 30). APT‑C‑23 group evolves its Android spyware. Retrieved March 4, 2024.","url":"https://web.archive.org/web/20201123042131/www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/"}]},{"id":"S1214","name":"Android/SpyAgent","url":"https://attack.mitre.org/software/S1214","kind":"malware","description":"[Android/SpyAgent](https://attack.mitre.org/software/S1214) can execute an automated phone call.(Citation: McAfee MoqHao 2019) ","relationship_id":"relationship--c6759fbe-ae7c-438e-9b30-dff3cc0b8e6c","references":[{"source_name":"McAfee MoqHao 2019","description":"Pak, C. (2019, August 7). MoqHao Related Android Spyware Targeting Japan and Korea Found on Google Play. Retrieved November 13, 2024.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/moqhao-related-android-spyware-targeting-japan-and-korea-found-on-google-play/"}]},{"id":"S1231","name":"GodFather","url":"https://attack.mitre.org/software/S1231","kind":"malware","description":"[GodFather](https://attack.mitre.org/software/S1231) has requested for the `CALL_PHONE` permission to initiate phone calls.(Citation: MerkleScience_Godfather_April2023)","relationship_id":"relationship--c836cf05-3e52-4b6e-8ade-a3e620dd32ad","references":[{"source_name":"MerkleScience_Godfather_April2023","description":"Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025.","url":"https://www.merklescience.com/blog/the-godfather-android-malware-threat-under-the-lens"}]},{"id":"S9004","name":"Crocodilus","url":"https://attack.mitre.org/software/S9004","kind":"malware","description":"[Crocodilus](https://attack.mitre.org/software/S9004) has the ability to enable call forwarding.(Citation: ThreatFabric_Crocodilus_March2025)","relationship_id":"relationship--10c912f6-6e0c-41a7-9911-f7fa5c9ba6f8","references":[{"source_name":"ThreatFabric_Crocodilus_March2025","description":"ThreatFabric. (2025, March 28). Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices. Retrieved November 24, 2025.","url":"https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices"}]},{"id":"S9005","name":"DocSwap","url":"https://attack.mitre.org/software/S9005","kind":"malware","description":"[DocSwap](https://attack.mitre.org/software/S9005) has requested for the `CALL_PHONE` permission to make phone calls.(Citation: EnkiWhiteHat_KimsukyDOCSWAP_Dec2025)(Citation: S2W_DocSwap_Mar2025)  ","relationship_id":"relationship--79872876-cb90-4371-9819-1bc51219d3f4","references":[{"source_name":"EnkiWhiteHat_KimsukyDOCSWAP_Dec2025","description":"EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026.","url":"https://www.enki.co.kr/en/media-center/blog/kimsuky-distributing-malicious-mobile-app-via-qr-code"},{"source_name":"S2W_DocSwap_Mar2025","description":"Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.","url":"https://medium.com/s2wblog/detailed-analysis-of-docswap-malware-disguised-as-security-document-viewer-218a728c36ff"}]},{"id":"S9006","name":"VajraSpy","url":"https://attack.mitre.org/software/S9006","kind":"malware","description":"[VajraSpy](https://attack.mitre.org/software/S9006) has requested for `android.permission.CALL_PHONE`.(Citation: K7Dhanalakshmi_VajraSpy_April2022) ","relationship_id":"relationship--e92e167d-d8b7-4429-bf60-d923f0a7f714","references":[{"source_name":"K7Dhanalakshmi_VajraSpy_April2022","description":"Dhanalakshmi. (2022, April 19).  VajraSpy – An Android RAT. Retrieved November 5, 2025.","url":"https://labs.k7computing.com/index.php/vajraspy-an-android-rat/"}]}],"actors":[],"mitigations":[{"id":"M1011","name":"User Guidance","url":"https://attack.mitre.org/mitigations/M1011","kind":"course-of-action","description":"Users should be encouraged to be very careful with what applications they grant phone call-based permissions to. Further, users should not change their default call handler to applications they do not recognize.","relationship_id":"relationship--afba6b19-7486-4e5a-8fda-e91852b0b354","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1516":"/ttp-simulation/techniques/mobile/T1516/","T1616":"/ttp-simulation/techniques/mobile/T1616/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1616","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0114","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","declared":true,"granted":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}}]}}