Adversaries may generate outbound traffic from devices. This is typically performed to manipulate external outcomes, such as to achieve carrier billing fraud or to manipulate app store rankings or ratings. Outbound traffic is typically generated as SMS messages or general web traffic, but may take other forms as well.
If done via SMS messages, Android apps must hold the SEND_SMS permission. Additionally, sending an SMS message requires user consent if the recipient is a premium number. Applications cannot send SMS messages on iOS
| ID | Name | Description |
|---|---|---|
| S0440 | Agent Smith |
Agent Smith shows fraudulent ads to generate revenue.[1] |
| S0525 | Android/AdDisplay.Ashas |
Android/AdDisplay.Ashas can generate revenue by automatically displaying ads.[2] |
| S0293 | BrainTest |
BrainTest provided capabilities that allowed developers to use compromised devices to post positive reviews on their own malicious applications as well as download other malicious applications they had submitted to the Play Store.[3] |
| S0432 | Bread |
Bread can perform SMS fraud on older versions of the malware, and toll fraud on newer versions.[4] |
| S1103 | FlixOnline |
FlixOnline can automatically send replies to a user’s incoming WhatsApp messages.[5] |
| S0290 | Gooligan | |
| S0322 | HummingBad |
HummingBad can create fraudulent statistics inside the official Google Play Store, and has generated revenue from installing fraudulent apps and displaying malicious advertisements.[7] |
| S0321 | HummingWhale |
HummingWhale generates revenue by displaying fraudulent ads and automatically installing apps. When victims try to close the ads, HummingWhale runs in a virtual machine, creating a fake ID that allows the perpetrators to generate revenue.[8] |
| S0325 | Judy |
Judy uses infected devices to generate fraudulent clicks on advertisements to generate revenue.[9] |
| S0303 | MazarBOT | |
| S0291 | PJApps |
PJApps has the capability to send messages to premium SMS messages.[11] |
| S0326 | RedDrop |
RedDrop tricks the user into sending SMS messages to premium services and then deletes those messages.[12] |
| S0419 | SimBad |
SimBad generates fraudulent advertising revenue by displaying ads in the background and by opening the browser and displaying ads.[13] |
| S0545 | TERRACOTTA |
TERRACOTTA has generated non-human advertising impressions.[14] |
| S0424 | Triada |
Triada can redirect ad banner URLs on websites visited by the user to specific ad URLs.[15][16] |
| S0494 | Zen |
| ID | Mitigation | Description |
|---|---|---|
| M1011 | User Guidance |
Users should be advised that applications generally do not require permission to send SMS messages. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0608 | Detection of Generate Traffic from Victim | AN1659 |
For Android, detect Generate Traffic from Victim by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: SmsManager.sendTextMessage() called by app NOT IN $ApprovedMessagingApps$]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1660 |
For iOS, detect Generate Traffic from Victim by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |