Exfiltration Over Alternative Protocol (T1639) is mobile malware sending stolen data out over a different protocol, or to a different destination, from the one it uses for command and control. ATT&CK lists FTP, SMTP, HTTP/S, DNS, SMB and web services such as cloud storage as examples, optionally encrypted or obfuscated. Splitting the two channels means that finding and blocking the C2 server does not stop the data leaving. MITRE ATT&CK v20 lists T1639 under Exfiltration for Android and iOS, with one sub-technique, Exfiltration Over Unencrypted Non-C2 Protocol (T1639.001). This is a short guide by design: ATT&CK itself says the technique is hard to detect directly. It is for mobile security engineers and SOC analysts deciding where to put their effort. For the matrix overview see the MITRE ATT&CK for Mobile Guide.
Key takeaways
- The exfiltration path is separate from C2. ATT&CK describes a different protocol, a different destination, or both.
- ATT&CK advises detecting earlier stages. Its v20 analytics for both platforms state that enterprises may be better served focusing on detection at other stages.
- The recorded cases use ordinary protocols. Email (TianySpy, BusyGasper), FTP (Corona Updates) and plain HTTP (VajraSpy) appear in ATT&CK v20.
- No mitigation is mapped. ATT&CK v20 maps none, so the controls are network egress policy and stopping the collection that precedes it.
- Unencrypted means visible. T1639.001 traffic can be inspected at a gateway, which is the one place this technique gives defenders an advantage.
What T1639 covers
| ID | Name | What ATT&CK describes | Software recorded in ATT&CK v20 |
|---|---|---|---|
| T1639 | Exfiltration Over Alternative Protocol | Data sent over a protocol other than the C2 channel, possibly to another location; may be encrypted or obfuscated | TianySpy (S1056): can exfiltrate collected user data, including credentials and authorised cookies, by email |
| T1639.001 | Exfiltration Over Unencrypted Non-C2 Protocol | Data sent over a natively unencrypted protocol such as HTTP, FTP or DNS; may be encoded (for example base64) or hidden in protocol headers and fields | BusyGasper (S0655): downloads commands from an FTP server and exfiltrates by email. Corona Updates (S0425): exfiltrates over FTP. VajraSpy (S9006): uploads unencrypted data over HTTP using the Retrofit client |
ATT&CK v20 lists both platforms. Of the recorded software, ATT&CK lists TianySpy for both Android and iOS; BusyGasper, Corona Updates and VajraSpy are Android only. The technique mirrors Enterprise T1048 and T1048.003; see the T1048 Exfiltration Over Alternative Protocol guide. When data leaves over the C2 channel itself, that is Exfiltration Over C2 Channel (T1646).
Where to detect it
ATT&CK v20 detection strategies DET0698 (T1639) and DET0701 (T1639.001) contain one Android and one iOS analytic each, and all four carry the same guidance: these techniques can be difficult to detect, and enterprises may be better served focusing on detection at other stages of adversarial behaviour. In practice that means three layers.
| Layer | What to watch | Data source |
|---|---|---|
| Before: collection | Apps holding sensitive permissions (SMS, contacts, call log) outside the approved list; bulk reads followed by uploads | MDM permission grant state; ATT&CK's Protected User Data analytics |
| During: egress | Managed apps connecting on FTP or SMTP ports, or making plain HTTP requests to destinations outside their baseline | Android network activity logging (ConnectEvent with package name and port); per-app VPN or gateway flow logs on iOS and Android |
| Content | Encoded payloads in HTTP fields or DNS labels from unencrypted channels | Secure web gateway or proxy inspection where deployed |
Android network activity logging records the package name, destination address and port of each TCP connection attempt, which is exactly the field needed to spot an app opening an SMTP or FTP session. It is enabled by a device owner (Android 8.0 or later) or a work profile owner (Android 12 or later), covers only work profile activity in the latter case, and does not capture UDP. That gap matters for DNS-based exfiltration, so DNS for managed devices should go through a resolver you log. See the DNS Logging and Detection Guide.
Metrics that show it is working
- Egress visibility: percentage of managed devices whose work traffic passes a gateway or VPN that logs per app.
- Legacy protocol connections: count of managed app connections on FTP or SMTP ports per week, with each one explained or blocked.
- Cleartext HTTP from managed apps: trended per app, aiming at zero for apps you build.
- Collection-stage alerts: unapproved sensitive permission grants found and removed, since ATT&CK points detection effort there.
Prevention and response
- Route work traffic through a managed tunnel. Always-on VPN with "Block connections without VPN" on Android, or per-app VPN on iOS, puts egress where you can filter it.
- Default-deny unusual egress. At the gateway, block outbound FTP and direct SMTP from mobile ranges unless a named app needs them; few mobile apps legitimately send mail directly.
- Stop cleartext in apps you build. Apps targeting Android API 28 or later block cleartext by default through Network Security Configuration; keep it that way and keep exceptions per domain. See the OWASP Mobile Top 10 M5 Insecure Communication Guide.
- Close the collection stage. Approved app lists for sensitive permissions, no sideloading on managed devices, Google Play Protect on.
- Respond: when egress from an unknown app is found, block the destination, remove the app through MDM, establish what it collected from its permissions, and follow the Data Exfiltration Playbook for scoping and notification.
Test egress blocks in report-only mode first: a field sales or engineering app may use FTP or SMTP legitimately, and an allow exception per app is safer than an open rule.
Where identity fits
TianySpy's recorded behaviour is exfiltrating credentials and authorised cookies. Cookies and tokens let an adversary resume a session without the password or second factor. If exfiltration from a managed device is confirmed, revoke sessions and refresh tokens for accounts used on it, not only passwords. See the Mobile Access Credentials guide.
Common failure patterns
- Blocking the C2 server and calling it contained. The defining feature of T1639 is that data leaves another way.
- No per-app egress data. Without package or app attribution, an SMTP session is just traffic from a phone.
- Ignoring DNS. Android network logging skips UDP, so DNS needs its own logging.
- Waiting for exfiltration to detect. ATT&CK's own advice is to invest in earlier stages, where the signals are stronger.
Framework mapping
| Framework | Reference | Why it applies |
|---|---|---|
| ATT&CK Enterprise | T1048; T1048.003 | Enterprise equivalent and its unencrypted sub-technique |
| NIST SP 800-53 Rev. 5 | SC-7 Boundary Protection; SI-4 System Monitoring; SC-8 Transmission Confidentiality and Integrity | Filter and monitor egress; protect data in transit for apps you build |
| NIST CSF 2.0 | DE.CM-01; PR.DS-02 | Monitor networks; protect data in transit |
Practitioner checklist
- Send managed device work traffic through always-on or per-app VPN.
- Block outbound FTP and direct SMTP from mobile traffic unless an approved app needs it.
- Log DNS for managed devices at a resolver you control.
- Enable Android network activity logging where you are device or work profile owner.
- Keep cleartext disabled in apps you build and review exceptions per release.
- Prioritise collection-stage detection, as ATT&CK advises.
- On confirmed exfiltration, revoke tokens and cookies for accounts used on the device.
Standards and references
- MITRE ATT&CK: Exfiltration Over Alternative Protocol (T1639)
- MITRE ATT&CK: Exfiltration Over Unencrypted Non-C2 Protocol (T1639.001)
- Android Developers: Network activity logging
- Android Developers: VPN
- Android Developers: Network security configuration
- OWASP: Mobile Application Security Verification Standard
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide · T1048 Exfiltration Over Alternative Protocol · Data Exfiltration Guide · Mobile Malware Guide