Activity timeline
T1481 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 3 reports, and 11 of the 11 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1481 Web Service is catalogued by MITRE ATT&CK under the Command and Control (Mobile) tactic in the Mobile matrix. Threadlinqs maps 11 of 2623 tracked threats (0.4%) to it; by severity that is 11 high.
Threats that use T1481 most often also use T1426 System Information Discovery (10 threats), T1646 Exfiltration Over C2 Channel (10 threats), T1429 Audio Capture (7 threats), T1430 Location Tracking (7 threats), T1437 Application Layer Protocol (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
4 tracked threat actors appear in the threats that use T1481; the most frequent are APT37 (1), Intellexa Consortium (1), MoYu Group (1), NSO Group (1).
Threat actors using it
Tracked threats
11 tracked threats use T1481.
- Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…high
- JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnethigh
- Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targetshigh
- SparkKitty: Cross-Platform iOS/Android Stealer Using OCR to Harvest Crypto Wallet Seed Phrases from App…high
- Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…high
- Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…high
- Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…high
- BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…high
- ScarCruft (APT37) BirdCall Android Variant — Multiplatform Supply-Chain Attack via sqgame[.]com[.]cn…high
- NGate Android NFC Relay Malware Variant - Trojanized HandyPay Banking App Campaign Targeting Brazil…high
- ZeroDayRAT Commercial Mobile Spyware — Telegram-Sold Cross-Platform Android/iOS Surveillance, Live…high
Detection coverage
Threadlinqs maintains 18 detection rules mapped to T1481 (SPL 6, KQL 6, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1481.001 Dead Drop Resolver — 2 tracked threats
- T1481.002 Bidirectional Communication — 3 tracked threats
- T1481.003 One-Way Communication — 0 tracked threats