aol.pm

Exfiltration Over C2 Channel

Technique · ATTACK:mobile:T1646

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1646",
  "title": "Exfiltration Over C2 Channel",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1646",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--32063d7f-0a39-440d-a4a3-2694488f96cc",
  "external_id": "T1646",
  "domain": "mobile",
  "created": "2022-04-01T15:43:45.913Z",
  "modified": "2026-05-12T15:12:00.624Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "exfiltration"
  ],
  "source_references": [
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-29.html",
      "external_id": "APP-29"
    }
  ]
}

Explicit source assertions (31)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0100020b-97d4-4657-bc71-c6a1774055a6

Lookout Uyghur Campaign

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f70bdf1-a6a7-406c-a4c0-cee509ff8369

nccgroup_sharkbot_0322

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1151b8cc-035b-46e2-ab5a-46e719ef97f8

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S1054 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b065fcf-7ed1-4f88-8910-2eb46bde9ab7

cyble_drinik_1022

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--349c2f82-1166-4dab-88d0-cfe920804b70

welivesecurity_ahrat_0523

ATTACK:mobile:S1241 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a13ea43-f3d7-4b12-93fa-65eb44d02b5e

ZimperiumGupta_RatMilad_Oct2022

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3dd0cd4d-bcde-4105-b98e-b32add191083

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fdb8bfb-1b2d-4fac-bb41-d26a5ad18dbb

cyble_chameleon_0423

ATTACK:mobile:S0418 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41da5845-a1a8-4d10-8929-053be3496396

SecureList - ViceLeaker 2019 · Bitdefender - Triout 2018

ATTACK:mobile:C0016 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cb926c1-c242-45c2-be46-07c22435a8a5

Cylance Dust Storm

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5976af4f-2fd4-46a0-baab-a4ae69e98bc1

LinkedIn Dmitry LightSpy 2025

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66be8672-6075-4309-b287-c9b81249f610

MerkleScience_Godfather_April2023 · ZimperiumOrtegaPratapagiri_GodFather_Jun2025

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bb4de7d-1ef9-4bc8-8d34-62e176d4188a

lookout_abstractemu_1021

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--724e1b64-7c9b-4a8f-a2ab-3f9cab539e68

lookout_bouldspy_0423

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bc6460d-b36e-41ed-baa0-82d54ec19e57

lookout_hornbill_sunbird_0221

ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94077e81-4098-48fa-a1db-cd0c926a3d24

ESETStefanko_NGateVariant_Apr2026

ATTACK:mobile:S0326 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--945db15a-b356-4e05-a6a0-9b24ca9aa348

Wandera-RedDrop

ATTACK:mobile:S1093 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--980430c1-6173-440e-b75e-c1cdb4c41560

Zimperium FlyTrap

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98632824-9fe4-4992-aafe-31c5eac66ec1

cleafy_brata_0122

ATTACK:mobile:S1080 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6323cf4-8141-4910-8743-e42cd15b49e9

kaspersky_fakecalls_0422

ATTACK:mobile:S1225 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb6e0232-8205-4ae8-80a8-659d33056ac8

TrendMicro_CherryBlos_July2023

ATTACK:mobile:C0033 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbd619c8-bd9a-4107-a60f-7a3a9f953735

trendmicro_strongpity · welivesec_strongpity

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbb07bef-f1da-41f6-b786-4a255e8bf985

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0424 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d32003ba-959b-4377-aa04-f75275c32abf

Google Triada June 2019

ATTACK:mobile:S1067 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e34c8c23-be8f-4da9-b051-5246e5f16ba8

proofpoint_flubot_0421

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e49f5d6a-4b8f-4649-9eb2-489524184feb

S2W_DocSwap_Mar2025

ATTACK:mobile:S0507 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1130c77-3d20-4c41-9e75-1953bf9b8abc

Lookout eSurv

ATTACK:mobile:S1215 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2e75022-ff16-44a8-8fcc-18c785406fb5

SecureList OpTriangulation 23Oct2023

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f33632d6-e0e7-4236-89da-0e41266c9a98

ESET_VajraSpy_Feb2024

ATTACK:mobile:S0490 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f517a7ce-dfdc-4f42-84c1-fef136e2ea19

TrendMicro-XLoader-FakeSpy

ATTACK:mobile:S0399 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb587f81-1300-438d-a33b-f8d08530788b

Lookout Dark Caracal Jan 2018

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.