T1644: Out of Band Data
Adversaries may communicate with compromised devices using out of band data streams. This could be done for a variety of reasons, including evading network traffic monitoring, as a backup method of command and control, or for data exfiltration if the device is not connected to any Internet-providing networks (i.e. cellular or Wi-Fi). Several out of band data streams exist, such as SMS messages, NFC, and Bluetooth.
On Android, applications can read push notifications to capture content from SMS messages, or other out of band data streams. This requires that the user manually grant notification access to the application via the settings menu. However, the application could launch an Intent to take the user directly there.
On iOS, there is no way to programmatically read push notifications.
Security context for executives and security teams
Out of Band Data matters because a compromised mobile device may communicate or leak data through channels that normal Internet monitoring may not see, such as SMS, NFC, or Bluetooth. For leaders, the key risk is not just malware on Android or iOS; it is the possibility that mobile command-and-control or exfiltration can bypass controls built mainly around Wi-Fi, cellular data, and perimeter network logs.
Executive priority
Treat this as a mobile visibility and governance issue. Ask whether high-risk users and business-critical mobile workflows have controls and evidence for risky permissions, SMS-related exposure, Bluetooth/NFC use, and user-granted notification access on Android. The ATT&CK relationships show this behavior across multiple mobile malware families, including Android and iOS examples, so it should inform mobile security requirements, incident response playbooks, and audit evidence for managed or bring-your-own mobile devices.
Technical view
SOC and IR teams should validate coverage separately for Android and iOS. On Android, ATT&CK notes that applications can read push notifications, including SMS content, if the user manually grants notification access; an app may also launch an Intent that takes the user directly to that settings area. On iOS, ATT&CK states there is no way to programmatically read push notifications, so detection expectations should not be copied directly from Android. Because no official ATT&CK detection text is provided, use the related DET0688 strategy as a pointer to build local analytics around mobile configuration, app behavior, and non-Internet communication evidence rather than relying only on network egress monitoring.
Likely telemetry
- Mobile device inventory and platform context for Android and iOS devices
- Installed application inventory and application reputation or provenance where available
- Android notification access grant state and changes to sensitive user-granted settings
- Evidence of apps launching or directing users into sensitive settings screens, where mobile telemetry supports it
- SMS-related metadata or security events available through enterprise mobile tooling or carrier/MDM integrations
Detection direction
- Do not assume enterprise network monitoring covers this technique; the behavior is specifically relevant when communication uses SMS, NFC, Bluetooth, or another out-of-band stream.
- For Android, prioritize detection and review of unexpected notification access grants, especially for apps without a clear business need.
- Tune investigations around user-driven permission changes, because the ATT&CK description requires manual user granting of notification access on Android; false positives may include legitimate accessibility, messaging, or productivity apps.
- Separate Android and iOS logic: ATT&CK explicitly notes iOS cannot programmatically read push notifications, so Android notification-access detections should not be treated as iOS coverage.
- Use related software context as threat-intelligence enrichment, not proof of local exposure: multiple Android malware entries and some iOS software are linked as using this technique.
Mitigation priorities
- Start with M1011 User Guidance: train users not to grant notification access or similar sensitive permissions to untrusted or unnecessary apps.
- Define acceptable mobile app sources and permission expectations for managed devices, with extra scrutiny for apps requesting notification access or access related to messaging and short-range communications.
- For higher-risk users, review Android notification access settings and remove unnecessary grants as part of mobile hardening and incident readiness.
- Where business operations allow, establish policy guidance for Bluetooth and NFC use on sensitive devices, recognizing that these are named out-of-band streams in the ATT&CK description.
- Make mobile IR playbooks account for out-of-band communication so responders do not close investigations solely because standard network logs show little or no exfiltration path.
Additional notes and limits
This technique is especially relevant to organizations whose mobile security program is centered on Internet traffic inspection but has limited device-level visibility. The relationship set includes many Android software examples and iOS examples such as Pegasus for iOS and TriangleDB, but those relationships should be used to prioritize defensive validation rather than to infer current targeting or compromise.
ATT&CK provides no official detection text and no tactics for this object in the supplied fields. Practical detection depends heavily on local mobile management, mobile threat defense, endpoint telemetry, carrier data availability, device ownership model, and privacy/legal constraints. The supplied mitigation relationship is limited to User Guidance, so additional controls should be validated against the organization’s own mobile platform capabilities.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Out of Band Data
Adversaries may communicate with compromised devices using out of band data streams. This could be done for a variety of reasons, including evading network traffic monitoring, as a backup method of command and control, or for data exfiltration if the device is not connected to any Internet-providing networks (i.e. cellular or Wi-Fi). Several out of band data streams exist, such as SMS messages, NFC, and Bluetooth.
On Android, applications can read push notifications to capture content from SMS messages, or other out of band data streams. This requires that the user manually grant notification access to the application via the settings menu. However, the application could launch an Intent to take the user directly there.
On iOS, there is no way to programmatically read push notifications.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Mobile | T1438 | Exfiltration Over Other Network Medium | Exfiltration Over Other Network Medium revoked by this object. |
Groups, software, and campaigns
S0505: Desert Scorpion
Desert Scorpion is surveillanceware that has targeted the Middle East, specifically individuals located in Palestine. Desert Scorpion is suspected to have been operated by the threat actor APT-C-23.[1]
There are multiple close variants of Desert Scorpion, such as VAMP[2], GnatSpy[3], FrozenCell and SpyC23, which add some additional functionality but are not significantly different from the original malware.
S0407: Monokle
S1216: TriangleDB
TriangleDB is an Objective-C written implant deployed after Binary Validator and after root privileges are obtained during Operation Triangulation’s infection chain. Upon execution, TriangleDB communicates with the C2 server, relaying information about the victim device.[1]
S1055: SharkBot
S0411: Rotexy
S0289: Pegasus for iOS
Pegasus for iOS is the iOS version of malware that has reportedly been linked to the NSO Group. It has been advertised and sold to target high-value victims.[1][2] The Android version is tracked separately under Pegasus for Android.
S0328: Stealth Mango
Stealth Mango is Android malware that has reportedly been used to successfully compromise the mobile devices of government officials, members of the military, medical professionals, and civilians. The iOS malware known as Tangelo is believed to be from the same developer. [1]
S0427: TrickMo
S0295: RCSAndroid
RCSAndroid is Android malware. [1]
S0324: SpyDealer
S0406: Gustuff
S1195: SpyC23
SpyC23 is a mobile malware that has been used by APT-C-23 since at least 2017. SpyC23 has been observed primarily targeting Android devices in the Middle East.[1]
There are multiple close variants of SpyC23, such as VAMP[2], GnatSpy[3], Desert Scorpion and FrozenCell, which add some additional functionality but are not significantly different from the original malware.
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.1 | Current bundle | 89e07a446e3d… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Lookout Desert Scorpion
A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.
Open source URL - [2]Lookout-Monokle
Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
Open source URL - [3]SecureList OpTriangulation 21Jun2023
Kucherin, G., et al. (2023, June 21). Dissecting TriangleDB, a Triangulation spyware implant. Retrieved April 18, 2024.
Open source URL - [4]nccgroup_sharkbot_0322
RIFT: Research and Intelligence Fusion Team. (2022, March 3). SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store. Retrieved January 18, 2023.
Open source URL - [5]securelist rotexy 2018
T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
Open source URL - [6]Lookout-Pegasus
Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.
Open source URL - [7]Lookout-StealthMango
Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.
Open source URL - [8]SecurityIntelligence TrickMo
P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.
Open source URL - [9]TrendMicro-RCSAndroid
Veo Zhang. (2015, July 21). Hacking Team RCSAndroid Spying Tool Listens to Calls; Roots Devices to Get In. Retrieved December 22, 2016.
- [10]PaloAlto-SpyDealer
Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.
Open source URL - [11]Talos Gustuff Apr 2019
Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.
Open source URL - [12]welivesecurity_apt-c-23
Stefanko, L. (2020, September 30). APT‑C‑23 group evolves its Android spyware. Retrieved March 4, 2024.
Open source URL - [13]lookout_bouldspy_0423
Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.
Open source URL - [14]Kaspersky-Skygofree
Nikita Buchka and Alexey Firsh. (2018, January 16). Skygofree: Following in the footsteps of HackingTeam. Retrieved September 24, 2018.
Open source URL - [15]Kaspersky-WUC
Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.
Open source URL - [16]SecureList BusyGasper
Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.
Open source URL - [17]Lookout Uyghur Campaign
A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
Open source URL - [18]Lookout-PegasusAndroid
Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.
Open source URL - [19]mitre-attackT1644Open source URL
- [20]mitre-attackT1644Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.