1. Home
  2. Techniques
  3. Mobile
  4. Out of Band Data

Out of Band Data

Adversaries may communicate with compromised devices using out of band data streams. This could be done for a variety of reasons, including evading network traffic monitoring, as a backup method of command and control, or for data exfiltration if the device is not connected to any Internet-providing networks (i.e. cellular or Wi-Fi). Several out of band data streams exist, such as SMS messages, NFC, and Bluetooth.

On Android, applications can read push notifications to capture content from SMS messages, or other out of band data streams. This requires that the user manually grant notification access to the application via the settings menu. However, the application could launch an Intent to take the user directly there.

On iOS, there is no way to programmatically read push notifications.

ID: T1644
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
ⓘ
Tactic: Command and Control
ⓘ
Platforms: Android, iOS
Version: 2.1
Created: 06 April 2022
Last Modified: 24 October 2025

Procedure Examples

ID Name Description
S0304 Android/Chuli.A

Android/Chuli.A used SMS to receive command and control messages.[1]
S1079 BOULDSPY

BOULDSPY can use SMS to send C2 commands.[2]
S0655 BusyGasper

BusyGasper can perform actions when one of two hardcoded magic SMS strings is received.[3]
S0529 CarbonSteal

CarbonSteal has used specially crafted SMS messages to control the target device.[4]

S0505 Desert Scorpion

Desert Scorpion can be controlled using SMS messages.[5]
S0406 Gustuff

Gustuff can use SMS for command and control from a defined admin phone number.[6]

S0407 Monokle

Monokle can be controlled via email and SMS from a set of "control phones."[7]
S9040 NGate

NGate has used NFC to send the victim's card information through a server to an adversary-controlled device.[8][9][10]
S0316 Pegasus for Android

Pegasus for Android uses SMS for command and control.[11]
S0289 Pegasus for iOS

Pegasus for iOS uses SMS for command and control.[12]
S0295 RCSAndroid

RCSAndroid can use SMS for command and control.[13]
S0411 Rotexy

Rotexy can be controlled through SMS messages.[14]
S1055 SharkBot

SharkBot can use the "Direct Reply" feature of Android to automatically reply to notifications with a message provided by C2.[15]
S0327 Skygofree

Skygofree can be controlled via binary SMS.[16]
S1195 SpyC23

SpyC23 can receive Command and Control commands from SMS messages.[17]
S0324 SpyDealer

SpyDealer enables remote control of the victim through SMS channels.[18]
S0328 Stealth Mango

Stealth Mango uses commands received from text messages for C2.[19]
S1216 TriangleDB

TriangleDB has used the Protobuf library for command and control communication.[20]

S0427 TrickMo

TrickMo can be controlled via encrypted SMS message.[21]

Mitigations

ID Mitigation Description
M1011 User Guidance

Users should be instructed to not grant applications unexpected or unnecessary permissions.

Detection Strategy

ID Name Analytic ID Analytic Description
DET0688 Detection of Out of Band Data AN1798

For Android, detect Out of Band Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: NotificationListenerService.onNotificationPosted() receiving notifications from source_app IN $HighValueNotifApps$ by listener NOT IN $NotificationAllowList$]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; System Notifications via Android Enterprise / Managed App Telemetry [Documented DPC/admin callbacks or managed-app generated event telemetry]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
AN1799

For iOS, detect Out of Band Data by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]; Protected Configuration via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.

References

  1. Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.
  2. Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.
  3. Alexey Firsh. (2018, August 29). BusyGasper – the unfriendly spy. Retrieved October 1, 2021.
  4. A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.
  5. A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.
  6. Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.
  7. Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
  8. Stefanko, L., Osmani, J. (2024, August 22). NGate Android malware relays NFC traffic to steal cash. Retrieved November 10, 2025.
  9. Ratajczak, K. (2025, November 3). Analysis of NGate malware campaign (NFC relay). Retrieved November 10, 2025.
  10. Stefanko, L. (2026, April 21). New NGate variant hides in a trojanized NFC payment app. Retrieved May 6, 2026.
  11. Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017.
  1. Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.
  2. Veo Zhang. (2015, July 21). Hacking Team RCSAndroid Spying Tool Listens to Calls; Roots Devices to Get In. Retrieved December 22, 2016.
  3. T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
  4. RIFT: Research and Intelligence Fusion Team. (2022, March 3). SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store. Retrieved January 18, 2023.
  5. Nikita Buchka and Alexey Firsh. (2018, January 16). Skygofree: Following in the footsteps of HackingTeam. Retrieved September 24, 2018.
  6. Stefanko, L. (2020, September 30). APT‑C‑23 group evolves its Android spyware. Retrieved March 4, 2024.
  7. Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018.
  8. Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018.
  9. Kucherin, G., et al. (2023, June 21). Dissecting TriangleDB, a Triangulation spyware implant. Retrieved April 18, 2024.
  10. P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.