aol.pm

Out of Band Data

Technique · ATTACK:mobile:T1644

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1644",
  "title": "Out of Band Data",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1644",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--ec4c4baa-026f-43e8-8f56-58c36f3162dd",
  "external_id": "T1644",
  "domain": "mobile",
  "created": "2022-04-06T15:27:34.300Z",
  "modified": "2025-10-24T17:49:34.162Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [

  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0505 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05243ccb-0aeb-4db4-bb03-51a65fb715ab

Lookout Desert Scorpion

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--069b2328-442b-491e-962d-d3fe01f0549e

Lookout-Monokle

ATTACK:mobile:S1216 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cd58f68-2c93-4ecc-a7fb-b4aad483d14a

SecureList OpTriangulation 21Jun2023

ATTACK:mobile:S1055 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e8607f6-daab-44df-b167-105403a4ef41

nccgroup_sharkbot_0322

ATTACK:mobile:S0411 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3272111a-f31d-47d5-a266-1749255b5016

securelist rotexy 2018

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4220ec84-3c30-462b-9bad-4fb4de42cfd4

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f2ae057-ef0b-4995-b24d-348a76a74a4f

Lookout-Pegasus

ATTACK:mobile:S0328 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a7295a2-ad95-4362-8b2c-9265ad5c73b0

Lookout-StealthMango

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7defdb15-65d1-40ca-a9da-5c0484892484

SecurityIntelligence TrickMo

ATTACK:mobile:S0295 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8cb42e3d-69f4-4b0d-98c9-0bb7560947c1

TrendMicro-RCSAndroid

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--935fd3e3-dd47-4c43-bdd8-1668af26395f

PaloAlto-SpyDealer

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96569099-db95-4f3c-8ded-6d9cf023e55e

Talos Gustuff Apr 2019

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa490344-f7e0-4e5a-abb1-af9209f15ce4

welivesecurity_apt-c-23

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b22addc1-6a23-4657-8164-3705e12bb95b

lookout_bouldspy_0423

ATTACK:mobile:S0327 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc0d2cbb-30fa-40e6-a250-bf6e5d8f9005

Kaspersky-Skygofree

ATTACK:mobile:S0304 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c83c84e8-a556-4efe-ae24-75970ee8ad4b

Kaspersky-WUC

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1318f71-7f70-4820-a3fc-0d05af038733

SecureList BusyGasper

ATTACK:mobile:S0529 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e33106e1-16ef-41b8-8d47-78c9f2b4dceb

Lookout Uyghur Campaign

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6098dca-3a9e-4991-8d51-1310b12161b6

Lookout-PegasusAndroid

ATTACK:mobile:S9040 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7cd4065-0649-4159-b45d-f6b585f45727

CERTPL_NGate_Nov2025 · ESETStefanko_NGateVariant_Apr2026 · ESETStefankoOsmani_NGate_Aug2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.