{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1646","id":"T1646","name":"Exfiltration Over C2 Channel","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1646","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"4956e9b490945bd53005c32c136b9281747a2898821df37deca93cc716d97d86","description":"Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1646","external_id":"T1646"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-29.html","external_id":"APP-29"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","parent":null,"children":[],"telemetry":[{"id":"proposed-lab-gateway-network-flows","name":"Lab gateway network flows","page":"telemetry/proposed-lab-gateway-network-flows/","kind":"proposed_input","category":"Network and protocol telemetry","description":"Flow observations at the mobile/OT lab gateway.","collection_focus":"Mirror the isolated lab egress and preserve device address leases/NAT mapping, byte counters and observation direction.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["gateway","device_ip","destination_ip","bytes_sent"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-lab-gateway-network-flows","collector":"illustrative-lab-collector","observation":{"gateway":"lab-gw-1","device_ip":"192.0.2.10","destination_ip":"198.51.100.20","bytes_sent":128}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"proposed_input","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"proposed-outbound-transfer-volume-and-destination-context","name":"Outbound transfer volume and destination context","page":"telemetry/proposed-outbound-transfer-volume-and-destination-context/","kind":"proposed_input","category":"Network and protocol telemetry","description":"Transfer-volume measurements enriched with destination context for a bounded period.","collection_focus":"Aggregate outbound bytes with explicit window/direction and enrich from permitted destination metadata; preserve enrichment provenance.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["device_id","window_seconds","outbound_bytes","destination","classification"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-outbound-transfer-volume-and-destination-context","collector":"illustrative-lab-collector","observation":{"device_id":"android-lab-1","window_seconds":60,"outbound_bytes":4096,"destination":"198.51.100.20","classification":"lab_endpoint"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"proposed_input","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"mobile/T1646","id":"T1646","name":"Exfiltration Over C2 Channel","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1646","technique_page":"techniques/mobile/T1646/","page":"detections/mobile/T1646/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0615","name":"Detection of Exfiltration Over C2 Channel","url":"https://attack.mitre.org/detectionstrategies/DET0615","stix_id":"x-mitre-detection-strategy--3ead6ecd-8ecb-40c9-8a73-ee3272bf0deb","relationship_id":"relationship--aed2ecd1-999d-485e-a43c-a1b2965de981","description":"","analytics":[{"id":"AN1671","name":"Analytic 1671","guidance":"Exfiltration Over C2 Channel can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0615#AN1671","platforms":["Android"],"tuning":[],"log_sources":[]},{"id":"AN1672","name":"Analytic 1672","guidance":"Exfiltration Over C2 Channel can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0615#AN1672","platforms":["iOS"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-lab-gateway-network-flows","name":"Lab gateway network flows","tag":"Proposed: Lab gateway network flows","page":"telemetry/proposed-lab-gateway-network-flows/","kind":"proposed_input"},{"id":"proposed-outbound-transfer-volume-and-destination-context","name":"Outbound transfer volume and destination context","tag":"Proposed: Outbound transfer volume and destination context","page":"telemetry/proposed-outbound-transfer-volume-and-destination-context/","kind":"proposed_input"}],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0326","name":"RedDrop","url":"https://attack.mitre.org/software/S0326","kind":"malware","description":"[RedDrop](https://attack.mitre.org/software/S0326) uses standard HTTP for exfiltration.(Citation: Wandera-RedDrop)","relationship_id":"relationship--945db15a-b356-4e05-a6a0-9b24ca9aa348","references":[{"source_name":"Wandera-RedDrop","description":"Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20180618225805/https://www.wandera.com/reddrop-malware/"}]},{"id":"S0399","name":"Pallas","url":"https://attack.mitre.org/software/S0399","kind":"malware","description":"[Pallas](https://attack.mitre.org/software/S0399) exfiltrates data using HTTP.(Citation: Lookout Dark Caracal Jan 2018)","relationship_id":"relationship--fb587f81-1300-438d-a33b-f8d08530788b","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"S0418","name":"ViceLeaker","url":"https://attack.mitre.org/software/S0418","kind":"malware","description":"[ViceLeaker](https://attack.mitre.org/software/S0418) uses HTTP data exfiltration.(Citation: SecureList - ViceLeaker 2019)(Citation: Bitdefender - Triout 2018)","relationship_id":"relationship--41da5845-a1a8-4d10-8929-053be3496396","references":[{"source_name":"SecureList - ViceLeaker 2019","description":"GReAT. (2019, June 26).  ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.","url":"https://securelist.com/fanning-the-flames-viceleaker-operation/90877/"},{"source_name":"Bitdefender - Triout 2018","description":"L. Arsene, C. Ochinca. (2018, August 20). Triout – Spyware Framework for Android with Extensive Surveillance Capabilities. Retrieved January 21, 2020.","url":"https://labs.bitdefender.com/2018/08/triout-spyware-framework-for-android-with-extensive-surveillance-capabilities/"}]},{"id":"S0421","name":"GolfSpy","url":"https://attack.mitre.org/software/S0421","kind":"malware","description":"[GolfSpy](https://attack.mitre.org/software/S0421) exfiltrates data using HTTP POST requests.(Citation: Trend Micro Bouncing Golf 2019)","relationship_id":"relationship--3dd0cd4d-bcde-4105-b98e-b32add191083","references":[{"source_name":"Trend Micro Bouncing Golf 2019","description":"E. Xu, G. Guo. (2019, June 28).  Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/"}]},{"id":"S0424","name":"Triada","url":"https://attack.mitre.org/software/S0424","kind":"malware","description":"[Triada](https://attack.mitre.org/software/S0424) utilized HTTP to exfiltrate data through POST requests to the command and control server.(Citation: Google Triada June 2019) ","relationship_id":"relationship--d32003ba-959b-4377-aa04-f75275c32abf","references":[{"source_name":"Google Triada June 2019","description":"Lukasz Siewierski. (2019, June 6). PHA Family Highlights: Triada. Retrieved July 16, 2019.","url":"https://security.googleblog.com/2019/06/pha-family-highlights-triada.html"}]},{"id":"S0490","name":"XLoader for iOS","url":"https://attack.mitre.org/software/S0490","kind":"malware","description":"[XLoader for iOS](https://attack.mitre.org/software/S0490) has exfiltrated data using HTTP requests.(Citation: TrendMicro-XLoader-FakeSpy)","relationship_id":"relationship--f517a7ce-dfdc-4f42-84c1-fef136e2ea19","references":[{"source_name":"TrendMicro-XLoader-FakeSpy","description":"Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-version-of-xloader-that-disguises-as-android-apps-and-an-ios-profile-holds-new-links-to-fakespy/"}]},{"id":"S0507","name":"eSurv","url":"https://attack.mitre.org/software/S0507","kind":"malware","description":"[eSurv](https://attack.mitre.org/software/S0507) has exfiltrated data using HTTP PUT requests.(Citation: Lookout eSurv)","relationship_id":"relationship--f1130c77-3d20-4c41-9e75-1953bf9b8abc","references":[{"source_name":"Lookout eSurv","description":"A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.","url":"https://blog.lookout.com/esurv-research"}]},{"id":"S0551","name":"GoldenEagle","url":"https://attack.mitre.org/software/S0551","kind":"malware","description":"[GoldenEagle](https://attack.mitre.org/software/S0551) has exfiltrated data via both SMTP and HTTP.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--0100020b-97d4-4657-bc71-c6a1774055a6","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S1054","name":"Drinik","url":"https://attack.mitre.org/software/S1054","kind":"malware","description":"[Drinik](https://attack.mitre.org/software/S1054) can send stolen data back to the C2 server.(Citation: cyble_drinik_1022)","relationship_id":"relationship--2b065fcf-7ed1-4f88-8910-2eb46bde9ab7","references":[{"source_name":"cyble_drinik_1022","description":"Cyble. (2022, October 27). Drinik Malware Returns With Advanced Capabilities Targeting Indian Taxpayers. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20221114031945/https://blog.cyble.com/2022/10/27/drinik-malware-returns-with-advanced-capabilities-targeting-indian-taxpayers/"}]},{"id":"S1055","name":"SharkBot","url":"https://attack.mitre.org/software/S1055","kind":"malware","description":"[SharkBot](https://attack.mitre.org/software/S1055) can exfiltrate captured user credentials and event logs back to the C2 server. (Citation: nccgroup_sharkbot_0322)","relationship_id":"relationship--0f70bdf1-a6a7-406c-a4c0-cee509ff8369","references":[{"source_name":"nccgroup_sharkbot_0322","description":"RIFT: Research and Intelligence Fusion Team. (2022, March 3). SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store. Retrieved January 18, 2023.","url":"https://research.nccgroup.com/2022/03/03/sharkbot-a-new-generation-android-banking-trojan-being-distributed-on-google-play-store/"}]},{"id":"S1061","name":"AbstractEmu","url":"https://attack.mitre.org/software/S1061","kind":"malware","description":"[AbstractEmu](https://attack.mitre.org/software/S1061) can send large amounts of device data over its C2 channel, including the device’s manufacturer, model, version and serial number, telephone number, and IP address.(Citation: lookout_abstractemu_1021)","relationship_id":"relationship--6bb4de7d-1ef9-4bc8-8d34-62e176d4188a","references":[{"source_name":"lookout_abstractemu_1021","description":"P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-global-rooting-malware-campaign"}]},{"id":"S1067","name":"FluBot","url":"https://attack.mitre.org/software/S1067","kind":"malware","description":"[FluBot](https://attack.mitre.org/software/S1067) can send contact lists to its C2 server.(Citation: proofpoint_flubot_0421)","relationship_id":"relationship--e34c8c23-be8f-4da9-b051-5246e5f16ba8","references":[{"source_name":"proofpoint_flubot_0421","description":"Crista Giering, F. Naves, Andrew Conway, Adam McNeil . (2021, April 27). FluBot Android Malware Spreading Rapidly Through Europe, May Hit U.S. Soon. Retrieved February 28, 2023.","url":"https://www.proofpoint.com/us/blog/threat-insight/flubot-android-malware-spreading-rapidly-through-europe-may-hit-us-soon"}]},{"id":"S1077","name":"Hornbill","url":"https://attack.mitre.org/software/S1077","kind":"malware","description":"[Hornbill](https://attack.mitre.org/software/S1077) can exfiltrate data back to the C2 server using HTTP.(Citation: lookout_hornbill_sunbird_0221) ","relationship_id":"relationship--7bc6460d-b36e-41ed-baa0-82d54ec19e57","references":[{"source_name":"lookout_hornbill_sunbird_0221","description":"Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict"}]},{"id":"S1079","name":"BOULDSPY","url":"https://attack.mitre.org/software/S1079","kind":"malware","description":"[BOULDSPY](https://attack.mitre.org/software/S1079) has exfiltrated cached data from infected devices.(Citation: lookout_bouldspy_0423)","relationship_id":"relationship--724e1b64-7c9b-4a8f-a2ab-3f9cab539e68","references":[{"source_name":"lookout_bouldspy_0423","description":"Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.","url":"https://www.lookout.com/blog/iranian-spyware-bouldspy"}]},{"id":"S1080","name":"Fakecalls","url":"https://attack.mitre.org/software/S1080","kind":"malware","description":"[Fakecalls](https://attack.mitre.org/software/S1080) can send exfiltrated data back to the C2 server.(Citation: kaspersky_fakecalls_0422)","relationship_id":"relationship--b6323cf4-8141-4910-8743-e42cd15b49e9","references":[{"source_name":"kaspersky_fakecalls_0422","description":"Igor Golovin. (2022, April 11). Fakecalls: a talking Trojan. Retrieved July 21, 2023.","url":"https://www.kaspersky.com/blog/fakecalls-banking-trojan/44072/"}]},{"id":"S1082","name":"Sunbird","url":"https://attack.mitre.org/software/S1082","kind":"malware","description":"[Sunbird](https://attack.mitre.org/software/S1082) can exfiltrate compressed ZIP files containing gathered info to C2 infrastructure.(Citation: lookout_hornbill_sunbird_0221)","relationship_id":"relationship--cbb07bef-f1da-41f6-b786-4a255e8bf985","references":[{"source_name":"lookout_hornbill_sunbird_0221","description":"Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict"}]},{"id":"S1083","name":"Chameleon","url":"https://attack.mitre.org/software/S1083","kind":"malware","description":"[Chameleon](https://attack.mitre.org/software/S1083) has sent stolen data over HTTP.(Citation: cyble_chameleon_0423)","relationship_id":"relationship--3fdb8bfb-1b2d-4fac-bb41-d26a5ad18dbb","references":[{"source_name":"cyble_chameleon_0423","description":"Cyble Research & Intelligence Labs. (2023, April 13). Banking Trojan targeting mobile users in Australia and Poland. Retrieved August 16, 2023.","url":"https://cyble.com/blog/chameleon-a-new-android-malware-spotted-in-the-wild/"}]},{"id":"S1093","name":"FlyTrap","url":"https://attack.mitre.org/software/S1093","kind":"malware","description":"[FlyTrap](https://attack.mitre.org/software/S1093) can use HTTP to exfiltrate data to the C2 server.(Citation: Zimperium FlyTrap)","relationship_id":"relationship--980430c1-6173-440e-b75e-c1cdb4c41560","references":[{"source_name":"Zimperium FlyTrap","description":"A. Yaswant. (2021, August 9). FlyTrap Android Malware Compromises Thousands of Facebook Accounts. Retrieved September 28, 2023.","url":"https://www.zimperium.com/blog/flytrap-android-malware-compromises-thousands-of-facebook-accounts/"}]},{"id":"S1094","name":"BRATA","url":"https://attack.mitre.org/software/S1094","kind":"malware","description":"[BRATA](https://attack.mitre.org/software/S1094) has exfiltrated data to the C2 server using HTTP requests.(Citation: cleafy_brata_0122)","relationship_id":"relationship--98632824-9fe4-4992-aafe-31c5eac66ec1","references":[{"source_name":"cleafy_brata_0122","description":"Federico Valentini, Francesco Lubatti. (2022, January 24). How BRATA is monitoring your bank account. Retrieved December 18, 2023.","url":"https://www.cleafy.com/cleafy-labs/how-brata-is-monitoring-your-bank-account"}]},{"id":"S1095","name":"AhRat","url":"https://attack.mitre.org/software/S1095","kind":"malware","description":"[AhRat](https://attack.mitre.org/software/S1095) can exfiltrate collected data to the C2, such as audio recordings and files.(Citation: welivesecurity_ahrat_0523)","relationship_id":"relationship--349c2f82-1166-4dab-88d0-cfe920804b70","references":[{"source_name":"welivesecurity_ahrat_0523","description":"Lukas Stefanko. (2023, May 23). Android app breaking bad: From legitimate screen recording to file exfiltration within a year. Retrieved December 18, 2023.","url":"https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) has exfiltrated collected data to the C2.(Citation: LinkedIn Dmitry LightSpy 2025)","relationship_id":"relationship--5976af4f-2fd4-46a0-baab-a4ae69e98bc1","references":[{"source_name":"LinkedIn Dmitry LightSpy 2025","description":"Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.","url":"https://www.linkedin.com/pulse/coordinated-kill-switch-lightspys-ios-destructive-plugin-bestuzhev-zhoye/"}]},{"id":"S1215","name":"Binary Validator","url":"https://attack.mitre.org/software/S1215","kind":"malware","description":"[Binary Validator](https://attack.mitre.org/software/S1215) has exfiltrated collected data to the C2 server.(Citation: SecureList OpTriangulation 23Oct2023) ","relationship_id":"relationship--f2e75022-ff16-44a8-8fcc-18c785406fb5","references":[{"source_name":"SecureList OpTriangulation 23Oct2023","description":"Kucherin, G., et al. (2023, October 23). The outstanding stealth of Operation Triangulation. Retrieved April 18, 2024.","url":"https://securelist.com/triangulation-validators-modules/110847/"}]},{"id":"S1225","name":"CherryBlos","url":"https://attack.mitre.org/software/S1225","kind":"malware","description":"[CherryBlos](https://attack.mitre.org/software/S1225) has exfiltrated credentials collected from pictures that have been analyzed using optical character recognition (OCR).(Citation: TrendMicro_CherryBlos_July2023) ","relationship_id":"relationship--bb6e0232-8205-4ae8-80a8-659d33056ac8","references":[{"source_name":"TrendMicro_CherryBlos_July2023","description":"Trend Micro Research. (2023, July 28). Related CherryBlos and FakeTrade Android Malware Involved in Scam Campaigns. Retrieved March 28, 2025.","url":"https://www.trendmicro.com/en_us/research/23/g/cherryblos-and-faketrade-android-malware-involved-in-scam-campai.html"}]},{"id":"S1231","name":"GodFather","url":"https://attack.mitre.org/software/S1231","kind":"malware","description":"[GodFather](https://attack.mitre.org/software/S1231) has exfiltrated sensitive information over C2.(Citation: ZimperiumOrtegaPratapagiri_GodFather_Jun2025)(Citation: MerkleScience_Godfather_April2023) ","relationship_id":"relationship--66be8672-6075-4309-b287-c9b81249f610","references":[{"source_name":"MerkleScience_Godfather_April2023","description":"Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025.","url":"https://www.merklescience.com/blog/the-godfather-android-malware-threat-under-the-lens"},{"source_name":"ZimperiumOrtegaPratapagiri_GodFather_Jun2025","description":"Ortega, F. Pratapagiri, V. (2025, June 18). Your Mobile App, Their Playground: The Dark Side of Virtualization. Retrieved July 16, 2025.","url":"https://zimperium.com/blog/your-mobile-app-their-playground-the-dark-side-of-the-virtualization"}]},{"id":"S1241","name":"RatMilad","url":"https://attack.mitre.org/software/S1241","kind":"malware","description":"[RatMilad](https://attack.mitre.org/software/S1241) has exfiltrated collected data to the C2.(Citation: ZimperiumGupta_RatMilad_Oct2022) ","relationship_id":"relationship--3a13ea43-f3d7-4b12-93fa-65eb44d02b5e","references":[{"source_name":"ZimperiumGupta_RatMilad_Oct2022","description":"Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.","url":"https://zimperium.com/blog/we-smell-a-ratmilad-mobile-spyware"}]},{"id":"S9004","name":"Crocodilus","url":"https://attack.mitre.org/software/S9004","kind":"malware","description":"[Crocodilus](https://attack.mitre.org/software/S9004) has the ability to send stolen data to C2.(Citation: ThreatFabric_Crocodilus_March2025) ","relationship_id":"relationship--1151b8cc-035b-46e2-ab5a-46e719ef97f8","references":[{"source_name":"ThreatFabric_Crocodilus_March2025","description":"ThreatFabric. (2025, March 28). Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices. Retrieved November 24, 2025.","url":"https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices"}]},{"id":"S9005","name":"DocSwap","url":"https://attack.mitre.org/software/S9005","kind":"malware","description":"[DocSwap](https://attack.mitre.org/software/S9005) has used a hardcoded IP address and port for C2 and exfiltration over socket communication.(Citation: S2W_DocSwap_Mar2025) ","relationship_id":"relationship--e49f5d6a-4b8f-4649-9eb2-489524184feb","references":[{"source_name":"S2W_DocSwap_Mar2025","description":"Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.","url":"https://medium.com/s2wblog/detailed-analysis-of-docswap-malware-disguised-as-security-document-viewer-218a728c36ff"}]},{"id":"S9006","name":"VajraSpy","url":"https://attack.mitre.org/software/S9006","kind":"malware","description":"[VajraSpy](https://attack.mitre.org/software/S9006) has exfiltrated captured data to C2 via POST requests.(Citation: ESET_VajraSpy_Feb2024) ","relationship_id":"relationship--f33632d6-e0e7-4236-89da-0e41266c9a98","references":[{"source_name":"ESET_VajraSpy_Feb2024","description":"Stefanko, L. (2024, February 1). VajraSpy: A Patchwork of espionage apps. Retrieved October 27, 2025.","url":"https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/"}]},{"id":"S9040","name":"NGate","url":"https://attack.mitre.org/software/S9040","kind":"malware","description":"[NGate](https://attack.mitre.org/software/S9040) has exfiltrated the victim’s payment card PIN to the C2 server via HTTP.(Citation: ESETStefanko_NGateVariant_Apr2026)","relationship_id":"relationship--94077e81-4098-48fa-a1db-cd0c926a3d24","references":[{"source_name":"ESETStefanko_NGateVariant_Apr2026","description":"Stefanko, L. (2026, April 21). New NGate variant hides in a trojanized NFC payment app. Retrieved May 6, 2026.","url":"https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/"}]}],"actors":[],"mitigations":[],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1646":"/ttp-simulation/techniques/mobile/T1646/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1646","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-lab-gateway-network-flows","collector":"illustrative-lab-collector","observation":{"gateway":"lab-gw-1","device_ip":"192.0.2.10","destination_ip":"198.51.100.20","bytes_sent":128}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-outbound-transfer-volume-and-destination-context","collector":"illustrative-lab-collector","observation":{"device_id":"android-lab-1","window_seconds":60,"outbound_bytes":4096,"destination":"198.51.100.20","classification":"lab_endpoint"}}]}}