MITRE ATT&CKtechnique

T1644 Out of Band Data

Published 2022-04-06 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Command And Control
Platforms
Android, iOS
Version
2.1
Created
2022-04-06

Description

Adversaries may communicate with compromised devices using out of band data streams. This could be done for a variety of reasons, including evading network traffic monitoring, as a backup method of command and control, or for data exfiltration if the device is not connected to any Internet-providing networks (i.e. cellular or Wi-Fi). Several out of band data streams exist, such as SMS messages, NFC, and Bluetooth. On Android, applications can read push notifications to capture content from SMS messages, or other out of band data streams. This requires that the user manually grant notification access to the application via the settings menu. However, the application could launch an Intent to take the user directly there. On iOS, there is no way to programmatically read push notifications.

Related

Tactic · MITRE ATT&CK (1)

  • TA0037 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1011 User Guidance mitigation

Referenced by MITRE ATT&CK · uses (19)

  • S9040 NGate software (malware)
  • S1216 TriangleDB software (malware)
  • S1195 SpyC23 software (malware)
  • S1079 BOULDSPY software (malware)
  • S1055 SharkBot software (malware)
  • S0655 BusyGasper software (malware)
  • S0529 CarbonSteal software (malware)
  • S0505 Desert Scorpion software (malware)
  • S0427 TrickMo software (malware)
  • S0411 Rotexy software (malware)
  • S0407 Monokle software (malware)
  • S0406 Gustuff software (malware)
  • S0324 SpyDealer software (malware)
  • S0327 Skygofree software (malware)
  • S0328 Stealth Mango software (malware)
  • S0289 Pegasus for iOS software (malware)
  • S0295 RCSAndroid software (malware)
  • S0304 Android/Chuli.A software (malware)
  • S0316 Pegasus for Android software (malware)