SIM Card Swap
Technique · ATTACK:mobile:T1451
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:T1451",
"title": "SIM Card Swap",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1451",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--a64a820a-cb21-471f-920c-506a2ff04fa5",
"external_id": "T1451",
"domain": "mobile",
"created": "2017-10-25T14:48:20.329Z",
"modified": "2025-02-12T16:26:38.632Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"initial-access"
],
"source_references": [
{
"source_name": "ATT SIM Swap Scams",
"url": "https://www.research.att.com/sites/cyberaware/ni/blog/sim_swap.html"
},
{
"source_name": "Verizon SIM Swapping",
"url": "https://www.verizon.com/about/account-security/sim-swapping"
},
{
"source_name": "NIST Mobile Threat Catalogue",
"url": "https://pages.nist.gov/mobile-threat-catalogue/stack-threats/STA-22.html",
"external_id": "STA-22"
}
]
}Explicit source assertions (4)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:G1015 → uses → ATTACK:mobile:T1451
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2167de58-8453-4ac3-977d-30a2b3526818
CrowdStrike Scattered Spider JUL 2025 · Check Point Scattered Spider JUL 2025 · Mandiant UNC3944 May 2025 · Mphasis SS_SIM_Swap Apr2024ATTACK:mobile:M1012 → mitigates → ATTACK:mobile:T1451
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d537065-9a82-42d5-923d-45194453cc25
ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1451
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8afc5b9-3ffc-4b3c-b2d8-ee2888a7b6ad
ATTACK:mobile:G1004 → uses → ATTACK:mobile:T1451
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7c95641-a685-4d0b-8516-9f0c7498efc9
Krebs LAPUSS Mar2022 · Microsoft DEV-0537 Mar2022