T1616 Call Control

Activity timeline

T1616 first appeared in tracked threats on 2026-06-16 and was most recently reported on 2026-10-28. The busiest month was 2026-07 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1616 Call Control is catalogued by MITRE ATT&CK under the Collection (Mobile) and Impact (Mobile) and Command and Control (Mobile) tactics in the Mobile matrix. Threadlinqs maps 10 of 3302 tracked threats (0.3%) to it; by severity that is 1 critical, 8 high, 1 medium.

Threats that use T1616 most often also use T1517 Access Notifications (9 threats), T1646 Exfiltration Over C2 Channel (9 threats), T1426 System Information Discovery (8 threats), T1582 SMS Control (8 threats), T1660 Phishing (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

Mitigations

MITRE ATT&CK lists 1 mitigation for T1616.

• M1011 User Guidance

Tracked threats

10 tracked threats use T1616.

• CyberDakait: Seven Android Trojan Families (GhostBat, cyb3rx, appkjl, godz, d-passive, d-shine, tenxen)…high2026-10-28
• MR ROBOT Android Malware-as-a-Service Targeting Indian Bank Customershigh2026-10-28
• Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure Russian Users via Fuel-Price and Drone-Strike Anxietymedium2026-10-28
• GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI PINs via Fake Traffic Challan / mParivahan SMS…high2026-10-15
• Mantax Otax: Indonesian Android Malware Combines Ransomware with Spyware Integrationhigh2026-09-09
• RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutionshigh2026-07-18
• Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…high2026-07-11
• Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committeecritical2026-07-05
• Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…high2026-07-03
• Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commandshigh2026-06-16

Detection coverage

Threadlinqs maintains 8 detection rules mapped to T1616 (SPL 2, KQL 3, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only.