MITRE ATT&CKtechnique

T1582 SMS Control

Published 2020-09-11 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Impact
Platforms
Android
Version
1.1
Created
2020-09-11

Description

Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware, or various external effects. This can be accomplished by requesting the `RECEIVE_SMS` or `SEND_SMS` permissions depending on what the malware is attempting to do. If the app is set as the default SMS handler on the device, the `SMS_DELIVER` broadcast intent can be registered, which allows the app to write to the SMS content provider. The content provider directly modifies the messaging database on the device, which could allow malicious applications with this ability to insert, modify, or delete arbitrary messages on the device.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1011 User Guidance mitigation

Referenced by MITRE ATT&CK · uses (33)

  • S9004 Crocodilus software (malware)
  • S1231 GodFather software (malware)
  • S1185 LightSpy software (malware)
  • S1195 SpyC23 software (malware)
  • S1095 AhRat software (malware)
  • S1092 Escobar software (malware)
  • S1067 FluBot software (malware)
  • S1069 TangleBot software (malware)
  • S1062 S.O.V.A. software (malware)
  • S1054 Drinik software (malware)
  • S1055 SharkBot software (malware)
  • S0655 BusyGasper software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0549 SilkBean software (malware)
  • S0551 GoldenEagle software (malware)
  • S0545 TERRACOTTA software (malware)
  • S0539 Red Alert 2.0 software (malware)
  • S0540 Asacub software (malware)
  • S0536 GPlayed software (malware)
  • S0522 Exobot software (malware)
  • S0509 FakeSpy software (malware)
  • S0505 Desert Scorpion software (malware)
  • S0489 WolfRAT software (malware)
  • S0485 Mandrake software (malware)
  • S0480 Cerberus software (malware)
  • S0425 Corona Updates software (malware)
  • S0427 TrickMo software (malware)
  • S0422 Anubis software (malware)
  • S0423 Ginp software (malware)
  • S0411 Rotexy software (malware)
Show all 33 ›

References