aol.pm

Call Control

Technique · ATTACK:mobile:T1616

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1616",
  "title": "Call Control",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1616",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--351ddf79-2d3a-41b4-9bef-82ea5d3ccd69",
  "external_id": "T1616",
  "domain": "mobile",
  "created": "2021-09-20T13:42:20.824Z",
  "modified": "2026-05-12T15:12:00.625Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "collection",
    "impact",
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "Android Permissions",
      "url": "https://developer.android.com/reference/android/Manifest.permission"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-41.html",
      "external_id": "APP-41"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-42.html",
      "external_id": "CEL-42"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-36.html",
      "external_id": "CEL-36"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-18.html",
      "external_id": "CEL-18"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06869cb8-7384-4d85-aa0a-78256133c88d

SentinelLabs AridViper 2023 · welivesecurity_apt-c-23

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10c912f6-6e0c-41a7-9911-f7fa5c9ba6f8

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cf04fb7-17a6-4424-a3f2-93f1b33d19cd

ThreatFabric_Chameleon_Dec2023

ATTACK:mobile:S1092 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a282967-0536-474d-8831-30cd60b818a9

Bleeipng Computer Escobar

ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4aae6ab8-2a67-4780-a69e-b15ecff7fc5d

cloudmark_tanglebot_0921

ATTACK:mobile:S1054 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e68feca-083f-40ed-88d8-2b6a3935c949

cyble_drinik_1022

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b670281-0054-42b4-8e54-ea01a692f5bf

SecureList BusyGasper

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--684c17bb-2075-4e1f-9fcb-17408511222d

Lookout Uyghur Campaign

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6935752c-e400-4dfa-863f-1d44a8f6dd50

Cofense Anubis

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--716f68ee-1e77-4254-8f67-d8f3c71db678

Lookout-Monokle

ATTACK:mobile:S9005 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79872876-cb90-4371-9819-1bc51219d3f4

EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · S2W_DocSwap_Mar2025

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80eb5ebc-ae6f-461e-8e78-a18702249343

mcafee_brata_0421

ATTACK:mobile:S1080 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ade5c0c5-8b53-4bc5-9d81-0284be2e5fee

kaspersky_fakecalls_0422

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afba6b19-7486-4e5a-8fda-e91852b0b354

ATTACK:mobile:S1214 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6759fbe-ae7c-438e-9b30-dff3cc0b8e6c

McAfee MoqHao 2019

ATTACK:mobile:S1231 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c836cf05-3e52-4b6e-8ade-a3e620dd32ad

MerkleScience_Godfather_April2023

ATTACK:mobile:S0292 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e50c605a-0cdf-4316-bb49-2deccc69143f

forcepoint_bitter

ATTACK:mobile:S9006 → uses → ATTACK:mobile:T1616

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e92e167d-d8b7-4429-bf60-d923f0a7f714

K7Dhanalakshmi_VajraSpy_April2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.