Threadlinqs IntelligenceStart free

ATT&CK techniqueCommand and Control (Mobile)

T1521 Encrypted Channel

Command and Control (Mobile)Mobile

As of 2026-10-05, T1521 (Encrypted Channel) appears in 12 tracked threats, first reported 2026-05-11 and most recently 2026-09-23; it most often appears alongside T1646 (Exfiltration Over C2 Channel).

Tracked threats
123 critical, 8 high, 1 medium
First seen
2026-05-11
Last seen
2026-09-23
Threat actors
—None attributed yet
Detection rules
25Blue tier and above

Data as of:

Activity timeline

T1521 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 6 reports, and 12 of the 12 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1521 Encrypted Channel is catalogued by MITRE ATT&CK under the Command and Control (Mobile) tactic in the Mobile matrix. Threadlinqs maps 12 of 2623 tracked threats (0.5%) to it; by severity that is 3 critical, 8 high, 1 medium.

Threats that use T1521 most often also use T1646 Exfiltration Over C2 Channel (10 threats), T1426 System Information Discovery (8 threats), T1437 Application Layer Protocol (8 threats), T1513 Screen Capture (8 threats), T1660 Phishing (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

Tracked threats

12 tracked threats use T1521.

Detection coverage

Threadlinqs maintains 25 detection rules mapped to T1521 (SPL 9, KQL 10, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.

25 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Sub-techniques

  • T1521.001 Symmetric Cryptography — 1 tracked threat
  • T1521.002 Asymmetric Cryptography — 0 tracked threats
  • T1521.003 SSL Pinning — 0 tracked threats