aol.pm

Broadcast Receivers

Subtechnique · ATTACK:mobile:T1624.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1624.001",
  "title": "Broadcast Receivers",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1624/001",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3775a580-a1d1-46c4-8147-c614a715f2e9",
  "external_id": "T1624.001",
  "domain": "mobile",
  "created": "2022-03-30T14:41:00.672Z",
  "modified": "2026-05-12T15:12:00.626Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "Android Changes to System Broadcasts",
      "url": "https://developer.android.com/guide/components/broadcasts#changes-system-broadcasts"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0305 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0008005f-ca51-47c3-8369-55ee5de1c65a

Zscaler-SpyNote

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--022e941f-30c3-45a9-9f6f-36e704b80060

SecurityIntelligence TrickMo

ATTACK:mobile:S0524 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bbe5936-04bf-4c9a-bb43-cd37f36c3349

Microsoft MalLockerB

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19df76ee-fa85-43cf-96ce-422d46f29a13

Lookout-PegasusAndroid

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20e8cf98-b5c1-4ad8-bdba-a9bad0344bef

welivesecurity_apt-c-23

ATTACK:mobile:S0419 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34a8a945-cc6c-474b-8db1-ffe8b5ecf99f

CheckPoint SimBad 2019

ATTACK:mobile:S0509 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c43d125-6719-420e-bb69-878cc91c2474

Cybereason FakeSpy

ATTACK:mobile:S0522 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f31b209-dbc7-4c7e-bb0a-e37801121c13

Threat Fabric Exobot

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--465d14e7-eb9e-4794-9cb3-1de2cff86a8e

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d6a900d-d1c4-4a91-bded-c9062aae384b

Zscaler TikTok Spyware

ATTACK:mobile:M1006 → mitigates → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ff5f854-bfe9-45bc-b11a-196cf826b760

Android Changes to System Broadcasts

ATTACK:mobile:S0536 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51d31e17-6c80-4ab3-9e8e-6231483e0999

Talos GPlayed

ATTACK:mobile:T1624.001 → subtechnique-of → ATTACK:mobile:T1624

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5619e263-d48c-47a5-ab68-8677fe080a15

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60439118-3ceb-490b-9df5-e35e7fca9009

welivesec_strongpity

ATTACK:mobile:S1103 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7863ef22-130a-4670-80c6-9bdeee58b8c9

checkpoint_flixonline_0421

ATTACK:mobile:S0544 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83d95d05-7545-4295-894b-f33a2ba1063b

Palo Alto HenBox

ATTACK:mobile:S0545 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c3296f6-3520-4d1b-8b57-bdd48a5aac91

WhiteOps TERRACOTTA

ATTACK:mobile:S0525 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a503ca06-7f98-4ab4-a8fc-ff55c3da7f0a

WeLiveSecurity AdDisplayAshas

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa210e0c-fa3e-4550-bf71-7ecf85f23ff2

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf19207a-ac71-436d-8ef4-4ab059b533c8

FortiGuard-FlexiSpy

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c75f3a08-b58f-4681-8ef0-75fa634503b9

welivesecurity_ahrat_0523

ATTACK:mobile:S0479 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c89f8f8d-222b-4b83-9fa4-47fd716a271f

ESET DEFENSOR ID

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4019493-bd52-4011-9355-8902be6ff3f3

PaloAlto-SpyDealer

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcda686d-0c3a-457a-a34d-6dcfb28f54bd

Cybereason EventBot

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.