Mobile ATT&CK Exfiltration Tactic: Spotting Data Leaving Android and iOS Devices

Mobile spyware and banking trojans exist to move data off the phone, yet the Exfiltration tactic is the one part of the mobile matrix where ATT&CK lists no mitigations at all. In MITRE ATT&CK for Mobile, Exfiltration (TA0036) covers how an adversary removes files and information from a device, and ATT&CK notes that phones often sit on cellular or public Wi-Fi networks outside enterprise control, where an attacker can also use non-IP channels such as SMS. ATT&CK v20 holds two techniques and one sub-technique under the tactic. This hub explains what the procedure data shows about how mobile data actually leaves, why prevention has to happen earlier in the chain, and which network, MDM, mobile threat defence and forensic signals give defenders a realistic chance to see it. It is written for SOC analysts, mobile and endpoint engineers, data protection owners and incident responders. For the whole matrix, see the MITRE ATT&CK for Mobile Guide.

Key takeaways

• Almost all mobile exfiltration rides the command channel. Exfiltration Over C2 Channel (T1646) has 31 recorded software or campaign uses in the v20 Mobile dataset, against 1 for Exfiltration Over Alternative Protocol (T1639) and 3 for its sub-technique T1639.001.
• There is no mitigation to switch on. ATT&CK v20 maps no mitigations to T1646, T1639 or T1639.001, so the controls that matter sit in Initial Access, Collection and Command and Control.
• The data stolen is personal and authentication data. Among the 34 entities that exfiltrate, 22 also collect SMS messages, 21 track location, 21 read local files and 20 capture audio.
• Network visibility depends on the ownership model. Android network activity logging works for a device owner from Android 8.0 and for a work profile owner from Android 12, records DNS and TCP connections only, and never covers the personal profile.
• Forensics fills the gap. When a high-risk user may be targeted by spyware, consensual analysis with the Mobile Verification Toolkit (MVT) and network indicators is often the only way to confirm data loss.

What Exfiltration means on a phone

A mobile implant rarely needs a separate exfiltration stage. Most malware in the ATT&CK record already holds an HTTPS connection to its server for commands, and simply sends collected SMS, contacts, audio or files back over it. That is T1646. A smaller group uses a different protocol or destination from the command channel, for example email or FTP, which is T1639, and T1639.001 covers the case where that alternative protocol is unencrypted.

The mobile setting makes this harder to see than on a corporate laptop. The device moves between cellular and Wi-Fi networks, the enterprise proxy is often not in the path, traffic is encrypted by default, and on bring-your-own devices the organisation sees only the work profile. ATT&CK's tactic text makes one point in the defender's favour: cellular data caps and charges can make heavy exfiltration noticeable to the user or the billing team.

Every Exfiltration technique in ATT&CK v20

Method: counts are distinct malware, tool, group and campaign objects with a non-revoked "uses" relationship to the technique in mobile-attack-20.0.json. All three apply to Android and iOS. Procedure counts reflect public reporting, not prevalence.

Where to start: priorities for defenders

1. T1646 over HTTPS first: it is where the data goes in practice. Detection relies on destination reputation, new or rare domains contacted by a single app, and volume patterns, not on content inspection. See the Mobile T1437 Application Layer Protocol page for the channel itself; Web Protocols (T1437.001) appears alongside exfiltration for 21 of the 34 entities.
2. Unencrypted and alternative protocols second: email, FTP and plain HTTP from a mobile app are unusual for business apps and easy to flag where traffic is visible. Android's Network Security Configuration blocks cleartext traffic by default for apps targeting API level 28 and later, so plain HTTP from a modern managed app is itself a signal.
3. SMS as a channel: ATT&CK's tactic text names SMS as a non-IP route. Treat any app holding SMS send permission without being the default messaging handler as suspicious.

How Exfiltration chains with the rest of the matrix

Counting the tactics used by the 34 entities that have an Exfiltration procedure in v20: Collection 33, Discovery 32, Defense Evasion 29, Command and Control 27, Credential Access 23, Initial Access 19, Impact 18, Persistence 11. The collection techniques that most often precede exfiltration are SMS Messages (T1636.004, 22 entities), Location Tracking (T1430, 21), Data from Local System (T1533, 21), Audio Capture (T1429, 20), Contact List (T1636.003, 19) and Call Log (T1636.002, 17).

• Banking trojan chain: phishing or a sideloaded app (see the Mobile ATT&CK Initial Access Tactic), then SMS and input capture of one-time codes, then upload over the HTTPS command channel. FluBot, GodFather and SharkBot are T1646 examples. The stolen codes are used against accounts, so the impact lands in identity systems.
• Spyware chain: exploitation, then broad collection of messages, audio, location and files, then exfiltration over the command channel. LightSpy and RatMilad are T1646 examples. See the Commercial Spyware Guide.
• Account-level exfiltration without device malware: Linked Devices (T1676), a Persistence and Collection technique, lets an adversary read Signal or WhatsApp messages on a device they control. ATT&CK records Star Blizzard linking WhatsApp accounts for message exfiltration. Network monitoring on the phone sees nothing; the control is checking the linked devices list.

Detection priorities and telemetry

ATT&CK v20 attaches a detection strategy to each of the three techniques. In practice, mobile exfiltration detection draws on four sources, and their reach depends on how the device is enrolled.

See the Mobile Verification Toolkit (MVT) guide, the Mobile Forensics Guide and the Mobile Threat Defense Buyer's Guide.

Analytics worth building

• Rare destination per app: a package name contacting a domain no other device in the fleet contacts, especially newly registered or dynamic DNS domains.
• Upload-heavy sessions: sustained outbound volume from a non-backup, non-media app, or uploads at night while the device is idle.
• Protocol mismatch: SMTP or FTP connections (TCP ports 25, 465, 587, 21) from a mobile app other than the managed mail client.
• Cleartext HTTP from a modern app: unusual given Android's default for API 28 and later.
• Post-install burst: an app installed outside the store that begins network activity immediately after receiving SMS or Accessibility permissions.

Metrics

• Share of corporate devices whose traffic is visible to a VPN, gateway or MTD filter.
• Share of Android work profiles and fully managed devices with network logging enabled and collected.
• Median time from a malicious domain block to the device being quarantined.
• Number of apps holding SMS read or send permissions that are not the default messaging handler.
• Time from a spyware threat notification to MVT triage for the affected user.

Reducing exfiltration when there is no direct mitigation

Because ATT&CK maps no mitigations to this tactic, the effective controls stop the stages before it or contain the identity damage after it.

Rollout order

1. Decide the visibility model: fully managed devices can route all traffic; BYOD work profiles see only work traffic. Document which devices you cannot see.
2. Enable logging in pilot: turn on network activity logging and MTD web filtering for a pilot group, confirm log collection, volume and privacy notices.
3. Baseline: collect two to four weeks of destinations per app before alerting, to learn normal sync and telemetry traffic.
4. Alert, then block: start with rare-destination and protocol-mismatch alerts; move confident indicators to blocking at the filter.
5. Containment path: define how a device loses access through conditional access, how SMS and session credentials are reset, and when MVT triage is offered. Rollback is a policy change, not a wipe.

Where identity fits

Much of what mobile malware exfiltrates is authentication material: SMS one-time codes, captured credentials and session cookies. TianySpy, for example, is recorded exfiltrating credentials and cookies by email. Once that data leaves the device, response belongs to the identity team: revoke sessions, reset credentials and remove SMS as a factor for the affected accounts. See the Conditional Access Guide for device compliance gating.

Common failure patterns

• Assuming encryption equals safety: T1646 traffic is usually HTTPS. Without destination intelligence, encrypted exfiltration looks like any other app.
• Logging only the work profile and calling it fleet coverage: malware in the personal profile of a BYOD device is invisible to work profile network logs by design.
• Not collecting network log batches: the system discards logs when the buffer fills or when logging is disabled, so an agent that does not retrieve batches promptly leaves gaps.
• Ignoring the messaging account: linked device abuse exfiltrates messages with no malware on the phone.
• Stopping at the device: wiping the phone without revoking the credentials and tokens it leaked leaves the account open.

Framework mapping

For the Enterprise view of the same tactic, see the ATT&CK Exfiltration Tactic guide, and for data controls the Data Loss Prevention (DLP) Guide.

Practitioner checklist

• Record, per device ownership model, which traffic the organisation can see and which it cannot.
• Enable Android network activity logging on fully managed devices and work profiles, and retrieve batches promptly.
• Route managed traffic through an always-on VPN, DNS filter or MTD web filter with malicious-domain blocking.
• Alert on rare destinations per app, SMTP or FTP from non-mail apps, and cleartext HTTP.
• Audit apps holding SMS, Accessibility and location permissions, and remove those without a business need.
• Block untrusted app installs, since most exfiltrating malware arrives that way.
• Check Signal and WhatsApp linked devices for high-risk users and during incidents.
• Pair device containment with credential and session revocation for the user.
• Offer consensual MVT triage to users who receive spyware threat notifications.

Standards and references

• MITRE ATT&CK: Exfiltration, Mobile (TA0036)
• MITRE ATT&CK: Mobile Matrix
• Android Developers: Network activity logging
• Android Developers: VPN
• Android Developers: Network security configuration
• NIST: SP 800-124 Rev 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise
• Amnesty International Security Lab: Mobile Verification Toolkit documentation

Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide, Mobile ATT&CK Collection Tactic, Mobile ATT&CK Command and Control Tactic, Mobile Spyware Infection Response Playbook.