Activity timeline
T1582 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1582 SMS Control is catalogued by MITRE ATT&CK under the Impact (Mobile) tactic in the Mobile matrix. Threadlinqs maps 10 of 2623 tracked threats (0.4%) to it; by severity that is 10 high.
Threats that use T1582 most often also use T1418 Software Discovery (10 threats), T1513 Screen Capture (9 threats), T1660 Phishing (9 threats), T1541 Foreground Persistence (8 threats), T1646 Exfiltration Over C2 Channel (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1582; the most frequent are Cyber Av3ngers (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1582.
Threat actors using it
Tracked threats
10 tracked threats use T1582.
- Mantax Otax: Indonesian Android Malware Combines Ransomware with Spyware Integrationhigh
- Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh
- ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT…high
- "BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platformhigh
- RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutionshigh
- Turkish Banking & Government-Portal Fraud Ecosystem: 8,400+ Phishing Domains, 6,700+ e-Devlet Lookalikes…high
- Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…high
- Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commandshigh
- BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…high
- TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL for Covert C2 Targeting Banking and Crypto Users…high
Detection coverage
Threadlinqs maintains 9 detection rules mapped to T1582 (SPL 1, KQL 4, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.