aol.pm

SMS Control

Technique · ATTACK:mobile:T1582

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1582",
  "title": "SMS Control",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1582",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b327a9c0-e709-495c-aa6e-00b042136e2b",
  "external_id": "T1582",
  "domain": "mobile",
  "created": "2020-09-11T15:14:33.730Z",
  "modified": "2026-05-12T15:12:00.708Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "impact"
  ],
  "source_references": [
    {
      "source_name": "Android SmsProvider",
      "url": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/7e7c274/src/com/android/providers/telephony/SmsProvider.java"
    },
    {
      "source_name": "SMS KitKat",
      "url": "https://android-developers.googleblog.com/2013/10/getting-your-sms-apps-ready-for-kitkat.html"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-16.html",
      "external_id": "APP-16"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-41.html",
      "external_id": "CEL-41"
    }
  ]
}

Explicit source assertions (34)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1054 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08a43019-d393-451f-a23c-2dfa17ec40b2

cyble_drinik_1022

ATTACK:mobile:S0425 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a610208-06af-425f-a9af-cd0899261e33

TrendMicro Coronavirus Updates

ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f116d99-9ce4-4790-aeda-ad9199d8bf7b

proofpoint_flubot_0421 · bitdefender_flubot_0524

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--174b139b-83ff-4cdc-889f-6e5936731741

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S0292 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--185764e3-b559-4a65-818e-1cad4db6d105

forcepoint_bitter

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e913583-123a-47af-8872-98fc12ab4a6a

Talos GPlayed

ATTACK:mobile:S0549 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f8b5252-551c-4a0d-8e72-8da4050757f3

Lookout Uyghur Campaign

ATTACK:mobile:S0539 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38f37e3f-1d4b-4f04-b176-1cae6d22931e

Sophos Red Alert 2.0

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ad83f33-c64a-4ad6-ab6f-0548c9dde257

Threat Fabric Exobot

ATTACK:mobile:S0328 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52ad5145-3b04-4cc8-bed8-4a14501afe25

Lookout-StealthMango

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b87bb01-9587-42bd-aa6b-30158ca8f55f

Cofense Anubis

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60da837d-a635-4533-b96a-db2689cc4771

welivesecurity_apt-c-23

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66ba3094-7c14-41b9-b7c1-814d026156b9

Talos-WolfRAT

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d659130-545b-4917-891c-6c1b7d54ed07

Zscaler TikTok Spyware

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--734fa2bf-17af-4e54-8d83-4cf9759e4ba9

Bitdefender Mandrake

ATTACK:mobile:S0480 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78fc4506-5c80-4638-8f51-44a2e28f7aaf

Threat Fabric Cerberus

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a8e1611-1a7e-45a0-b518-6efd744fce4f

Lookout Uyghur Campaign

ATTACK:mobile:S0301 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82555171-8b78-40f3-84d9-058359ae808a

Lookout-Dendroid

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f83d618-a42d-4797-b9fe-030affdbd13f

nccgroup_sharkbot_0322

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a67c5611-00bc-4e1a-a1be-2512a2bcf072

SMS KitKat

ATTACK:mobile:S0540 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a808c887-b2b8-4b05-9cab-47c918e48d48

Securelist Asacub

ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b19082d2-c151-45dd-8844-82335fbe3ed9

cloudmark_tanglebot_0921

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b477afcb-7449-4fae-b4aa-c512c22d7500

Cybereason FakeSpy

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4e73a6c-d523-4f3c-bcb6-200f63867fb4

SecurityIntelligence TrickMo

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c659256c-82e3-4f4c-ac70-3d2400cf6695

Lookout Desert Scorpion

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8559423-10b0-4d5e-9057-65cbfd7ee1c0

SecureList BusyGasper

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc345ae4-0d60-4f21-98b3-596c15118745

threatfabric_sova_0921

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cdf06664-903e-499b-86b4-b7bcce3c0740

Bleeipng Computer Escobar

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d09abcd8-49bf-4d0f-8b17-0db7ada10ec2

securelist rotexy 2018

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7d6f1dd-9ed2-48a5-8c81-6dc09181d3fd

MerkleScience_Godfather_April2023

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbdaa604-b94c-43d1-b8cc-e8e2bbc3fdce

welivesecurity_ahrat_0523

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e682fd05-a55e-447c-9de1-788cf061ba70

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2023 · Threatfabric LightSpy 2024

ATTACK:mobile:S0423 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb1eeb37-37a8-47b6-aff8-9703735a4d93

ThreatFabric Ginp

ATTACK:mobile:S0545 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f87bb2d2-e7fd-44ce-b537-e7e01086731c

WhiteOps TERRACOTTA

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.