Alternate Network Mediums

Adversaries can communicate using cellular networks rather than enterprise Wi-Fi in order to bypass enterprise network monitoring systems. Adversaries may also communicate using other non-Internet Protocol mediums such as SMS, NFC, or Bluetooth to bypass network monitoring systems.

ID: T1438
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
Platforms: Android, iOS
MTC ID: APP-30
Version: 1.0
Created: 25 October 2017
Last Modified: 17 October 2018
Provided by LAYER 8

Procedure Examples

ID Name Description
S0304 Android/Chuli.A

Android/Chuli.A used SMS to receive command and control messages.[1]

S0655 BusyGasper

BusyGasper can download text files with commands from an FTP server and exfiltrate data via email. It can also perform actions when one of two hardcoded magic SMS strings is received.[2]

S0529 CarbonSteal

CarbonSteal has used specially crafted SMS messages to control the target device.[3]

S0505 Desert Scorpion

Desert Scorpion can be controlled using SMS messages.[4]

S0406 Gustuff

Gustuff can use SMS for command and control from a defined admin phone number.[5]

S0407 Monokle

Monokle can be controlled via email and SMS from a set of "control phones."[6]

S0316 Pegasus for Android

Pegasus for Android uses SMS for command and control.[7]

S0289 Pegasus for iOS

Pegasus for iOS uses SMS for command and control.[8]

S0295 RCSAndroid

RCSAndroid can use SMS for command and control.[9]

S0411 Rotexy

Rotexy can be controlled through SMS messages.[10]

S0327 Skygofree

Skygofree can be controlled via binary SMS.[11]

S0324 SpyDealer

SpyDealer enables remote control of the victim through SMS channels.[12]

S0328 Stealth Mango

Stealth Mango uses commands received from text messages for C2.[13]

S0427 TrickMo

TrickMo can be controlled via encrypted SMS message.[14]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

References