{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1643","id":"T1643","name":"Generate Traffic from Victim","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1643","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"94b9ff90231a44f57ac15d5c62871b515d48c6052c67a293fae34c8a52f5d8ca","description":"Adversaries may generate outbound traffic from devices. This is typically performed to manipulate external outcomes, such as to achieve carrier billing fraud or to manipulate app store rankings or ratings. Outbound traffic is typically generated as SMS messages or general web traffic, but may take other forms as well.\n\nIf done via SMS messages, Android apps must hold the `SEND_SMS` permission. Additionally, sending an SMS message requires user consent if the recipient is a premium number. Applications cannot send SMS messages on iOS","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1643","external_id":"T1643"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-16.html","external_id":"APP-16"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0112","name":"API Calls","page":"telemetry/DC0112/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Instrumented mobile API calls and results relevant to an application behavior.","collection_focus":"Instrument selected APIs in the owned test app or approved research build; log caller, API, sanitized argument class and return status.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","api","result","thread"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0123","name":"Application State","page":"telemetry/DC0123/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Application state and lifecycle observations such as foreground/background transitions.","collection_focus":"Instrument the owned app lifecycle and corroborate permitted service snapshots; distinguish app events from inferred gateway activity.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","state_before","state_after","source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0123","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","state_before":"background","state_after":"foreground","source":"own_app_callback"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0116","name":"Permissions Request","page":"telemetry/DC0116/","kind":"attack_component","category":"Mobile lab instrumentation","description":"A system prompt for an application permission, with request and response context where observable.","collection_focus":"Correlate own-app request/callback instrumentation with the consented test-device prompt. A request callback alone does not prove a prompt appeared (for example, a previously denied permission).","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","permission","action","prompt_observed","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0116","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","action":"permission_prompt","prompt_observed":true,"result":"denied"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."}],"detection":{"key":"mobile/T1643","id":"T1643","name":"Generate Traffic from Victim","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1643","technique_page":"techniques/mobile/T1643/","page":"detections/mobile/T1643/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0608","name":"Detection of Generate Traffic from Victim","url":"https://attack.mitre.org/detectionstrategies/DET0608","stix_id":"x-mitre-detection-strategy--12414f0e-85ca-4403-873a-6d415c2020f4","relationship_id":"relationship--c2a684c0-29ad-4c5b-86c0-ef8be9c5d796","description":"","analytics":[{"id":"AN1659","name":"Analytic 1659","guidance":"For Android, detect Generate Traffic from Victim by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: SmsManager.sendTextMessage() called by app NOT IN $ApprovedMessagingApps$]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0608#AN1659","platforms":["Android"],"tuning":[{"field":"ApprovedMessagingApps","description":"Default SMS, approved messaging apps. Minimal."},{"field":"PremiumNumberPattern","description":"Country-specific premium short code ranges. Derive from carrier/regulatory database. Update per regulatory changes."},{"field":"SMSRateThreshold","description":"Default 5 premium SMS within window. Tightening: 2."},{"field":"SMSWindow","description":"Default 60s."}],"log_sources":[{"component_id":"DC0112","component":"API Calls","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: SmsManager.sendTextMessage() called by app NOT IN $ApprovedMessagingApps$","platforms":["Android"],"analytic_id":"AN1659","source_url":"https://attack.mitre.org/detectionstrategies/DET0608#AN1659","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0112/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"android:EnterpriseNetworkLog","channel":"DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata","platforms":["Android"],"analytic_id":"AN1659","source_url":"https://attack.mitre.org/detectionstrategies/DET0608#AN1659","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0116","component":"Permissions Request","name":"android:DevicePolicyManager","channel":"DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review","platforms":["Android"],"analytic_id":"AN1659","source_url":"https://attack.mitre.org/detectionstrategies/DET0608#AN1659","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0116/"}]},{"id":"AN1660","name":"Analytic 1660","guidance":"For iOS, detect Generate Traffic from Victim by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0608#AN1660","platforms":["iOS"],"tuning":[{"field":"AdNetworkDomainList","description":"Known ad network FQDNs. Derive from ad industry DNS data."},{"field":"HTTPRateThreshold","description":"Default 100 requests/60s — above human interaction rate. Derive from legitimate app baseline."},{"field":"FraudWindow","description":"Default 60s."}],"log_sources":[{"component_id":"DC0123","component":"Application State","name":"iOS:MDM","channel":"InstalledApplicationList / ManagedApplicationList","platforms":["iOS"],"analytic_id":"AN1660","source_url":"https://attack.mitre.org/detectionstrategies/DET0608#AN1660","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0123/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"iOS:NetworkExtension","channel":"NEFilterFlow / per-app VPN / secure-web-gateway flow metadata","platforms":["iOS"],"analytic_id":"AN1660","source_url":"https://attack.mitre.org/detectionstrategies/DET0608#AN1660","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"iOS:NetworkExtension","channel":"NEFilterFlow / per-app VPN / secure-web-gateway flow metadata","platforms":["iOS"],"analytic_id":"AN1660","source_url":"https://attack.mitre.org/detectionstrategies/DET0608#AN1660","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0112","name":"API Calls","tag":"API Calls","page":"telemetry/DC0112/","kind":"attack_component"},{"id":"DC0123","name":"Application State","tag":"Application State","page":"telemetry/DC0123/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0116","name":"Permissions Request","tag":"Permissions Request","page":"telemetry/DC0116/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0290","name":"Gooligan","url":"https://attack.mitre.org/software/S0290","kind":"malware","description":"[Gooligan](https://attack.mitre.org/software/S0290) can install adware to generate revenue.(Citation: Gooligan Citation)","relationship_id":"relationship--42ae42eb-ea75-457a-bf39-4ea04304dd0b","references":[{"source_name":"Gooligan Citation","description":"Check Point Research Team. (2016, November 30). More Than 1 Million Google Accounts Breached by Gooligan. Retrieved December 12, 2016.","url":"http://blog.checkpoint.com/2016/11/30/1-million-google-accounts-breached-gooligan/"}]},{"id":"S0291","name":"PJApps","url":"https://attack.mitre.org/software/S0291","kind":"malware","description":"[PJApps](https://attack.mitre.org/software/S0291) has the capability to send messages to premium SMS messages.(Citation: Lookout-EnterpriseApps)","relationship_id":"relationship--4454a696-7619-40ee-971b-cbf646e4ee61","references":[{"source_name":"Lookout-EnterpriseApps","description":"Lookout. (2016, May 25). 5 active mobile threats spoofing enterprise apps. Retrieved December 19, 2016.","url":"https://blog.lookout.com/blog/2016/05/25/spoofed-apps/"}]},{"id":"S0293","name":"BrainTest","url":"https://attack.mitre.org/software/S0293","kind":"malware","description":"[BrainTest](https://attack.mitre.org/software/S0293) provided capabilities that allowed developers to use compromised devices to post positive reviews on their own malicious applications as well as download other malicious applications they had submitted to the Play Store.(Citation: Lookout-BrainTest)","relationship_id":"relationship--6086e1e2-1b39-4ff2-910e-4a4eb86d57b7","references":[{"source_name":"Lookout-BrainTest","description":"Chris Dehghanpoor. (2016, January 6). Brain Test re-emerges: 13 apps found in Google Play  Read more: Brain Test re-emerges: 13 apps found in Google Play. Retrieved December 21, 2016.","url":"https://blog.lookout.com/blog/2016/01/06/brain-test-re-emerges/"}]},{"id":"S0303","name":"MazarBOT","url":"https://attack.mitre.org/software/S0303","kind":"malware","description":"[MazarBOT](https://attack.mitre.org/software/S0303) can send messages to premium-rate numbers.(Citation: Tripwire-MazarBOT)","relationship_id":"relationship--5a6df1dd-9aa4-4f67-9195-8c3a9f5c0f7a","references":[{"source_name":"Tripwire-MazarBOT","description":"Graham Cluley. (2016, February 16). Android users warned of malware attack spreading via SMS. Retrieved December 23, 2016.","url":"https://www.tripwire.com/state-of-security/security-data-protection/android-malware-sms/"}]},{"id":"S0321","name":"HummingWhale","url":"https://attack.mitre.org/software/S0321","kind":"malware","description":"[HummingWhale](https://attack.mitre.org/software/S0321) generates revenue by displaying fraudulent ads and automatically installing apps. When victims try to close the ads, [HummingWhale](https://attack.mitre.org/software/S0321) runs in a virtual machine, creating a fake ID that allows the perpetrators to generate revenue.(Citation: ArsTechnica-HummingWhale)","relationship_id":"relationship--b263e4e9-972d-4ba7-8be8-e55eb6a483c0","references":[{"source_name":"ArsTechnica-HummingWhale","description":"Dan Goodin. (2017, January 23). Virulent Android malware returns, gets >2 million downloads on Google Play. Retrieved January 24, 2017.","url":"http://arstechnica.com/security/2017/01/virulent-android-malware-returns-gets-2-million-downloads-on-google-play/"}]},{"id":"S0322","name":"HummingBad","url":"https://attack.mitre.org/software/S0322","kind":"malware","description":"[HummingBad](https://attack.mitre.org/software/S0322) can create fraudulent statistics inside the official Google Play Store, and has generated revenue from installing fraudulent apps and displaying malicious advertisements.(Citation: ArsTechnica-HummingBad)","relationship_id":"relationship--f947d845-4d70-41f3-ae3c-18ea8b44e667","references":[{"source_name":"ArsTechnica-HummingBad","description":"Dan Goodin. (2016, July 7). 10 million Android phones infected by all-powerful auto-rooting apps. Retrieved January 24, 2017.","url":"http://arstechnica.com/security/2016/07/virulent-auto-rooting-malware-takes-control-of-10-million-android-devices/"}]},{"id":"S0325","name":"Judy","url":"https://attack.mitre.org/software/S0325","kind":"malware","description":"[Judy](https://attack.mitre.org/software/S0325) uses infected devices to generate fraudulent clicks on advertisements to generate revenue.(Citation: CheckPoint-Judy)","relationship_id":"relationship--1c42ee3a-c400-4de6-84aa-b254422af7b9","references":[{"source_name":"CheckPoint-Judy","description":"CheckPoint. (2017, May 25). The Judy Malware: Possibly the largest malware campaign found on Google Play. Retrieved September 18, 2018.","url":"https://blog.checkpoint.com/2017/05/25/judy-malware-possibly-largest-malware-campaign-found-google-play/"}]},{"id":"S0326","name":"RedDrop","url":"https://attack.mitre.org/software/S0326","kind":"malware","description":"[RedDrop](https://attack.mitre.org/software/S0326) tricks the user into sending SMS messages to premium services and then deletes those messages.(Citation: Wandera-RedDrop)","relationship_id":"relationship--35c67a18-7e8d-4bd5-9fe1-35b1ac3f401f","references":[{"source_name":"Wandera-RedDrop","description":"Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20180618225805/https://www.wandera.com/reddrop-malware/"}]},{"id":"S0419","name":"SimBad","url":"https://attack.mitre.org/software/S0419","kind":"malware","description":"[SimBad](https://attack.mitre.org/software/S0419) generates fraudulent advertising revenue by displaying ads in the background and by opening the browser and displaying ads.(Citation: CheckPoint SimBad 2019)","relationship_id":"relationship--a04ae7d7-1500-49c9-bada-1a75a8670f5c","references":[{"source_name":"CheckPoint SimBad 2019","description":"Elena Root, Andrey Polkovnichenko. (2019, March 13). SimBad: A Rogue Adware Campaign On Google Play. Retrieved November 21, 2019.","url":"https://research.checkpoint.com/simbad-a-rogue-adware-campaign-on-google-play/"}]},{"id":"S0424","name":"Triada","url":"https://attack.mitre.org/software/S0424","kind":"malware","description":"[Triada](https://attack.mitre.org/software/S0424) can redirect ad banner URLs on websites visited by the user to specific ad URLs.(Citation: Google Triada June 2019)(Citation: Kaspersky Triada June 2016) ","relationship_id":"relationship--eef8fb1f-3e8c-44d7-b0d1-1fbad81e392f","references":[{"source_name":"Kaspersky Triada June 2016","description":"Kivva, A. (2016, June 6). Everyone sees not what they want to see. Retrieved July 16, 2019.","url":"https://securelist.com/everyone-sees-not-what-they-want-to-see/74997/"},{"source_name":"Google Triada June 2019","description":"Lukasz Siewierski. (2019, June 6). PHA Family Highlights: Triada. Retrieved July 16, 2019.","url":"https://security.googleblog.com/2019/06/pha-family-highlights-triada.html"}]},{"id":"S0432","name":"Bread","url":"https://attack.mitre.org/software/S0432","kind":"malware","description":"[Bread](https://attack.mitre.org/software/S0432) can perform SMS fraud on older versions of the malware, and toll fraud on newer versions.(Citation: Google Bread)","relationship_id":"relationship--b7a31a11-6c84-4c28-a548-4751e4d71134","references":[{"source_name":"Google Bread","description":"A. Guertin, V. Kotov, Android Security & Privacy Team. (2020, January 9). PHA Family Highlights: Bread (and Friends) . Retrieved April 27, 2020.","url":"https://security.googleblog.com/2020/01/pha-family-highlights-bread-and-friends.html"}]},{"id":"S0440","name":"Agent Smith","url":"https://attack.mitre.org/software/S0440","kind":"malware","description":"[Agent Smith](https://attack.mitre.org/software/S0440) shows fraudulent ads to generate revenue.(Citation: CheckPoint Agent Smith)","relationship_id":"relationship--4de3f794-63df-4f9e-8bd8-59796d91aa36","references":[{"source_name":"CheckPoint Agent Smith","description":"A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020.","url":"https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/"}]},{"id":"S0494","name":"Zen","url":"https://attack.mitre.org/software/S0494","kind":"malware","description":"[Zen](https://attack.mitre.org/software/S0494) can simulate user clicks on ads.(Citation: Google Security Zen)","relationship_id":"relationship--ce51f1b3-7813-4517-bbcf-7ae8abf6d2ef","references":[{"source_name":"Google Security Zen","description":"Siewierski, L. (2019, January 11). PHA Family Highlights: Zen and its cousins . Retrieved July 27, 2020.","url":"https://security.googleblog.com/2019/01/pha-family-highlights-zen-and-its.html"}]},{"id":"S0525","name":"Android/AdDisplay.Ashas","url":"https://attack.mitre.org/software/S0525","kind":"malware","description":"[Android/AdDisplay.Ashas](https://attack.mitre.org/software/S0525) can generate revenue by automatically displaying ads.(Citation: WeLiveSecurity AdDisplayAshas)","relationship_id":"relationship--08c81253-975c-4780-8e85-c72bc6a90c88","references":[{"source_name":"WeLiveSecurity AdDisplayAshas","description":"L. Stefanko. (2019, October 24). Tracking down the developer of Android adware affecting millions of users. Retrieved October 29, 2020.","url":"https://www.welivesecurity.com/2019/10/24/tracking-down-developer-android-adware/"}]},{"id":"S0545","name":"TERRACOTTA","url":"https://attack.mitre.org/software/S0545","kind":"malware","description":"[TERRACOTTA](https://attack.mitre.org/software/S0545) has generated non-human advertising impressions.(Citation: WhiteOps TERRACOTTA)","relationship_id":"relationship--13078a96-2cda-4d0b-99f8-693a65a4b63d","references":[{"source_name":"WhiteOps TERRACOTTA","description":"Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.","url":"https://www.whiteops.com/blog/terracotta-android-malware-a-technical-study"}]},{"id":"S1103","name":"FlixOnline","url":"https://attack.mitre.org/software/S1103","kind":"malware","description":"[FlixOnline](https://attack.mitre.org/software/S1103) can automatically send replies to a user’s incoming WhatsApp messages.(Citation: checkpoint_flixonline_0421)","relationship_id":"relationship--e3009db5-d1d8-4869-b1ca-d408a052bb4e","references":[{"source_name":"checkpoint_flixonline_0421","description":"Aviran Hazum, Bodgan Melnykov, Israel Wenik. (2021, April 7). New Wormable Android Malware Spreads by Creating Auto-Replies to Messages in WhatsApp. Retrieved January 26, 2024.","url":"https://research.checkpoint.com/2021/new-wormable-android-malware-spreads-by-creating-auto-replies-to-messages-in-whatsapp/"}]}],"actors":[],"mitigations":[{"id":"M1011","name":"User Guidance","url":"https://attack.mitre.org/mitigations/M1011","kind":"course-of-action","description":"Users should be advised that applications generally do not require permission to send SMS messages.","relationship_id":"relationship--20dcd886-56c4-421d-ba36-0f37a47a3f86","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1643":"/ttp-simulation/techniques/mobile/T1643/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1643","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0123","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","state_before":"background","state_after":"foreground","source":"own_app_callback"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0116","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","permission":"android.permission.CAMERA","action":"permission_prompt","prompt_observed":true,"result":"denied"}}]}}