T1624.001: Broadcast Receivers
Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to subscribe to events such as receiving an SMS message, device boot completion, or other device activities.
An intent is a message passed between Android applications or system components. Applications can register to receive broadcast intents at runtime, which are system-wide intents delivered to each app when certain events happen on the device, such as network changes or the user unlocking the screen. Malicious applications can then trigger certain actions within the app based on which broadcast intent was received.
In addition to Android system intents, malicious applications can register for intents broadcasted by other applications. This allows the malware to respond based on actions in other applications. This behavior typically indicates a more intimate knowledge, or potentially the targeting of specific devices, users, or applications.
In Android 8 (API level 26), broadcast intent behavior was changed, limiting the implicit intents that applications can register for in the manifest. In most cases, applications that register through the manifest will no longer receive the broadcasts. Now, applications must register context-specific broadcast receivers while the user is actively using the app.[1]
Security context for executives and security teams
Broadcast Receivers matter because they let an Android app wake up or act when device or application events occur, such as SMS receipt, boot completion, network changes, or screen unlock. For a business, the risk is not the broadcast mechanism itself, which is normal Android behavior, but malicious or unwanted apps using it for persistence or event-driven execution on managed or employee devices.
Executive priority
Prioritize this where Android devices are used for privileged work, financial approval, messaging, field operations, or access to sensitive applications. Leaders should ask whether mobile device governance can identify risky apps, confirm Android OS currency, and provide incident responders with enough evidence to determine whether an app is reacting to system or other-app events. The supplied mitigation relationship points to keeping mobile OS versions current, especially because Android 8/API level 26 introduced restrictions on many manifest-registered implicit broadcasts.
Technical view
This is an Android sub-technique of Event Triggered Execution. SOC, mobile security, and IR teams should validate whether they can inspect installed apps for declared broadcast receivers, understand which receivers are registered at runtime when an app is active, and correlate suspicious app behavior with system or application broadcast events. ATT&CK does not provide detection text for this object, but it does identify DET0711, Detection of Broadcast Receivers, as related detection strategy context. Relationship context also shows repeated use by Android malware and surveillanceware families, so receiver analysis should be part of mobile malware triage rather than treated as inherently malicious by itself.
Likely telemetry
- Android application package metadata, including manifest-declared broadcast receivers and requested intent filters
- Runtime or dynamic analysis evidence showing context-registered broadcast receivers while an app is in use
- Mobile device inventory with installed applications, package names, versions, sources, and Android OS/API level
- Mobile security or EMM/MDM events for suspicious app behavior, app installation, app update, and policy violations
- Device event context such as boot completion, SMS receipt, network changes, user unlock, or relevant inter-application broadcasts where available
Detection direction
- Do not alert solely on the presence of broadcast receivers; legitimate Android applications commonly use them. Focus review on receivers tied to sensitive triggers, unexpected persistence behavior, or actions inconsistent with the app’s business purpose.
- Tune detection around Android version differences. On Android 8/API level 26 and later, many manifest-registered implicit broadcasts are restricted, so runtime receiver behavior and app-in-use context may be more important.
- For high-risk apps, compare declared receivers and intent filters against observed behavior during dynamic analysis or sandboxing.
- Use relationship context to inform triage: the technique is associated in ATT&CK with multiple Android malware categories, including RATs, spyware, banking trojans, adware, ransomware, and surveillanceware, but local evidence is required before concluding maliciousness.
- Validate whether mobile telemetry covers personally owned or unmanaged Android devices if those devices can access enterprise data; this is a common visibility gap for mobile persistence behaviors.
Mitigation priorities
- Maintain recent Android OS versions where business constraints allow, aligning with ATT&CK mitigation M1006 Use Recent OS Version.
- Use mobile device management or equivalent governance to inventory Android OS/API level, installed applications, and app sources for devices accessing enterprise resources.
- Prioritize review of apps that request broad access or handle sensitive workflows, especially if they register receivers for boot, SMS, unlock, network, or other high-signal events.
- Restrict enterprise access from devices that cannot meet minimum OS and app governance requirements, where policy permits.
- Include broadcast receiver analysis in mobile malware response playbooks and application risk reviews rather than relying only on network indicators.
Additional notes and limits
This object is Android-specific and is a sub-technique of Event Triggered Execution. ATT&CK relationships show use by campaign C0033 and numerous Android software entries, including SpyNote RAT, Pegasus for Android, SpyDealer, FlexiSpy, SimBad, GolfSpy, TrickMo, EventBot, DEFENSOR ID, FakeSpy, Exobot, AndroidOS/MalLocker.B, Android/AdDisplay.Ashas, GPlayed, HenBox, TERRACOTTA, Tiktok Pro, AhRat, and FlixOnline. Those relationships support treating the behavior as relevant to mobile persistence and malware triage, not as proof that any given app is malicious.
ATT&CK provides no official detection text and no tactic value for this object in the supplied fields. The take therefore identifies validation and telemetry priorities rather than guaranteed detections. Determining risk requires local app inventory, Android version data, app behavior analysis, and enterprise mobile access context.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Broadcast Receivers
Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to subscribe to events such as receiving an SMS message, device boot completion, or other device activities.
An intent is a message passed between Android applications or system components. Applications can register to receive broadcast intents at runtime, which are system-wide intents delivered to each app when certain events happen on the device, such as network changes or the user unlocking the screen. Malicious applications can then trigger certain actions within the app based on which broadcast intent was received.
In addition to Android system intents, malicious applications can register for intents broadcasted by other applications. This allows the malware to respond based on actions in other applications. This behavior typically indicates a more intimate knowledge, or potentially the targeting of specific devices, users, or applications.
In Android 8 (API level 26), broadcast intent behavior was changed, limiting the implicit intents that applications can register for in the manifest. In most cases, applications that register through the manifest will no longer receive the broadcasts. Now, applications must register context-specific broadcast receivers while the user is actively using the app.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Mobile | T1624 | Event Triggered Execution | This object subtechnique of Event Triggered Execution. |
| Mobile | T1402 | Broadcast Receivers | Broadcast Receivers revoked by this object. |
Groups, software, and campaigns
S0305: SpyNote RAT
SpyNote RAT (Remote Access Trojan) is a family of malicious Android apps. The SpyNote RAT builder tool can be used to develop malicious apps with the malware's functionality. [1]
S0427: TrickMo
S0524: AndroidOS/MalLocker.B
AndroidOS/MalLocker.B is a variant of a ransomware family targeting Android devices. It prevents the user from interacting with the UI by displaying a screen containing a ransom note over all other windows. [1]
S0316: Pegasus for Android
Pegasus for Android is the Android version of malware that has reportedly been linked to the NSO Group. [1] [2] The iOS version is tracked separately under Pegasus for iOS.
S1195: SpyC23
SpyC23 is a mobile malware that has been used by APT-C-23 since at least 2017. SpyC23 has been observed primarily targeting Android devices in the Middle East.[1]
There are multiple close variants of SpyC23, such as VAMP[2], GnatSpy[3], Desert Scorpion and FrozenCell, which add some additional functionality but are not significantly different from the original malware.
S0419: SimBad
SimBad was a strain of adware on the Google Play Store, distributed through the RXDroider Software Development Kit. The name "SimBad" was derived from the fact that most of the infected applications were simulator games. The adware was controlled using an instance of the open source framework Parse Server.[1]
S0509: FakeSpy
S0522: Exobot
S0421: GolfSpy
GolfSpy is Android spyware deployed by the group Bouncing Golf.[1]
S0558: Tiktok Pro
Tiktok Pro is spyware that has been masquerading as the TikTok application.[1]
S0536: GPlayed
S1103: FlixOnline
FlixOnline is an Android malware, first detected in early 2021, believed to target users of WhatsApp. FlixOnline primarily spreads via automatic replies to a device’s incoming WhatsApp messages.[1]
C0033: C0033
C0033 was a PROMETHIUM campaign during which they used StrongPity to target Android users. C0033 was the first publicly documented mobile campaign for PROMETHIUM, who previously used Windows-based techniques.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 840c2ee94fa2… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Android Changes to System Broadcasts
Google. (2019, December 27). Broadcasts Overview. Retrieved January 27, 2020.
Open source URL - [2]Zscaler-SpyNote
Shivang Desai. (2017, January 23). SpyNote RAT posing as Netflix app. Retrieved January 26, 2017.
Open source URL - [3]SecurityIntelligence TrickMo
P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.
Open source URL - [4]Microsoft MalLockerB
D. Venkatesan. (2020, October 8). Sophisticated new Android malware marks the latest evolution of mobile ransomware . Retrieved October 29, 2020.
Open source URL - [5]Lookout-PegasusAndroid
Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.
Open source URL - [6]welivesecurity_apt-c-23
Stefanko, L. (2020, September 30). APT‑C‑23 group evolves its Android spyware. Retrieved March 4, 2024.
Open source URL - [7]CheckPoint SimBad 2019
Elena Root, Andrey Polkovnichenko. (2019, March 13). SimBad: A Rogue Adware Campaign On Google Play. Retrieved November 21, 2019.
Open source URL - [8]Cybereason FakeSpy
O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.
Open source URL - [9]Threat Fabric Exobot
Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.
Open source URL - [10]Trend Micro Bouncing Golf 2019
E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.
Open source URL - [11]Zscaler TikTok Spyware
S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.
Open source URL - [12]Talos GPlayed
V. Ventura. (2018, October 11). GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.
Open source URL - [13]welivesec_strongpity
Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023.
Open source URL - [14]checkpoint_flixonline_0421
Aviran Hazum, Bodgan Melnykov, Israel Wenik. (2021, April 7). New Wormable Android Malware Spreads by Creating Auto-Replies to Messages in WhatsApp. Retrieved January 26, 2024.
Open source URL - [15]Palo Alto HenBox
A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.
Open source URL - [16]WhiteOps TERRACOTTA
Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020.
Open source URL - [17]WeLiveSecurity AdDisplayAshas
L. Stefanko. (2019, October 24). Tracking down the developer of Android adware affecting millions of users. Retrieved October 29, 2020.
Open source URL - [18]EnkiWhiteHat_KimsukyDOCSWAP_Dec2025
EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026.
Open source URL - [19]S2W_DocSwap_Mar2025
Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.
Open source URL - [20]FortiGuard-FlexiSpy
K. Lu. (n.d.). Deep Technical Analysis of the Spyware FlexiSpy for Android. Retrieved September 10, 2019.
Open source URL - [21]welivesecurity_ahrat_0523
Lukas Stefanko. (2023, May 23). Android app breaking bad: From legitimate screen recording to file exfiltration within a year. Retrieved December 18, 2023.
Open source URL - [22]ESET DEFENSOR ID
L. Stefanko. (2020, May 22). Insidious Android malware gives up all malicious features but one to gain stealth. Retrieved June 26, 2020.
Open source URL - [23]PaloAlto-SpyDealer
Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.
Open source URL - [24]Cybereason EventBot
D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.
Open source URL - [25]Android Changes to System Broadcasts
Google. (2019, December 27). Broadcasts Overview. Retrieved January 27, 2020.
Open source URL - [26]mitre-attackT1624.001Open source URL
- [27]mitre-attackT1624.001Open source URL
- [28]Android Changes to System Broadcasts
Google. (2019, December 27). Broadcasts Overview. Retrieved January 27, 2020.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.