# T1509 Non-Standard Port

> As of 2026-11-08, T1509 (Non-Standard Port) appears in 10 tracked threats, first reported 2026-02-25 and most recently 2026-11-05, with linked actors including Balonx; it most often appears alongside T1513 (Screen Capture).

- **Tracked threats:** 10 (2 critical, 8 high)
- **First seen:** 2026-02-25
- **Last seen:** 2026-11-05
- **Threat actors:** 1
- **Detection rules:** 18 (counts only; unlock with TL Creds)

## Key facts

- **ID:** T1509
- **Framework:** MITRE ATT&CK
- **Tactics:** Command and Control (Mobile)
- **Matrix:** Mobile
- **Data as of:** 2026-11-08
- **MITRE:** https://attack.mitre.org/techniques/T1509/

## Activity timeline

T1509 first appeared in tracked threats on 2026-02-25 and was most recently reported on 2026-11-05. The busiest month was 2026-08 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.

## How adversaries use it

T1509 Non-Standard Port is catalogued by MITRE ATT&CK under the Command and Control (Mobile) tactic in the Mobile matrix. Threadlinqs maps 10 of 3697 tracked threats (0.3%) to it; by severity that is 2 critical, 8 high.

Threats that use T1509 most often also use [T1513 Screen Capture](https://intel.threadlinqs.com/technique/T1513) (8 threats), [T1646 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1646) (8 threats), [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (7 threats), [T1533 Data from Local System](https://intel.threadlinqs.com/technique/T1533) (7 threats), [T1541 Foreground Persistence](https://intel.threadlinqs.com/technique/T1541) (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

1 tracked threat actor appear in the threats that use T1509; the most frequent are [Balonx](https://intel.threadlinqs.com/actor/Balonx) (1).

## Threat actors using it

- [Balonx](https://intel.threadlinqs.com/actor/Balonx) — 1

## Tracked threats

10 tracked threats use T1509.

- [Mirax Android RAT: Server-side Device Takeover Targeting META Banking Customers via Malicious Ads in…](https://intel.threadlinqs.com/threat/TL-2026-5306) — high — 2026-11-05
- [Midnight Mimosa: Low-cost MediaTek Android phones ship with firmware-level ad-fraud and residential proxy…](https://intel.threadlinqs.com/threat/TL-2026-3066) — high — 2026-10-09
- [Balonx Sistema: Mexican Phishing-as-a-Service Platform Combines Real-Time MITM, Android RAT, and AI Vishing…](https://intel.threadlinqs.com/threat/TL-2026-2143) — critical — 2026-08-25
- [Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal…](https://intel.threadlinqs.com/threat/TL-2026-1832) — high — 2026-08-03
- [Copybara Android RAT Delivered via Fake N26 Support Vishing Calls](https://intel.threadlinqs.com/threat/TL-2026-1804) — high — 2026-08-01
- [Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…](https://intel.threadlinqs.com/threat/TL-2026-1098) — high — 2026-07-03
- [Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Play](https://intel.threadlinqs.com/threat/TL-2026-1059) — high — 2026-07-02
- [OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and…](https://intel.threadlinqs.com/threat/TL-2026-0598) — critical — 2026-05-27
- [TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL for Covert C2 Targeting Banking and Crypto Users…](https://intel.threadlinqs.com/threat/TL-2026-0494) — high — 2026-05-11
- [ResidentBat — Belarusian KGB Android Spyware at Internet Scale (ADB Sideloading, Custom HTTPS C2, Journalist…](https://intel.threadlinqs.com/threat/TL-2026-0143) — high — 2026-02-25

## Detection coverage

Threadlinqs maintains 18 detection rules mapped to T1509 (SPL 5, KQL 8, Sigma 5). Rule content unlocks with TL Creds on a free account; this page shows counts only.

18 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1509
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp