# T1616 Call Control > As of 2026-10-28, T1616 (Call Control) appears in 10 tracked threats, first reported 2026-06-16 and most recently 2026-10-28; it most often appears alongside T1517 (Access Notifications). - **Tracked threats:** 10 (1 critical, 8 high, 1 medium) - **First seen:** 2026-06-16 - **Last seen:** 2026-10-28 - **Detection rules:** 8 (counts only; Blue tier and above) ## Key facts - **ID:** T1616 - **Framework:** MITRE ATT&CK - **Tactics:** Collection (Mobile), Impact (Mobile), Command and Control (Mobile) - **Matrix:** Mobile - **Data as of:** 2026-10-28 - **MITRE:** https://attack.mitre.org/techniques/T1616/ ## Activity timeline T1616 first appeared in tracked threats on 2026-06-16 and was most recently reported on 2026-10-28. The busiest month was 2026-07 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1616 Call Control is catalogued by MITRE ATT&CK under the Collection (Mobile) and Impact (Mobile) and Command and Control (Mobile) tactics in the Mobile matrix. Threadlinqs maps 10 of 3302 tracked threats (0.3%) to it; by severity that is 1 critical, 8 high, 1 medium. Threats that use T1616 most often also use [T1517 Access Notifications](https://intel.threadlinqs.com/technique/T1517) (9 threats), [T1646 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1646) (9 threats), [T1426 System Information Discovery](https://intel.threadlinqs.com/technique/T1426) (8 threats), [T1582 SMS Control](https://intel.threadlinqs.com/technique/T1582) (8 threats), [T1660 Phishing](https://intel.threadlinqs.com/technique/T1660) (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. ## Mitigations MITRE ATT&CK lists 1 mitigation for T1616. - [M1011 User Guidance](https://attack.mitre.org/mitigations/M1011/) ## Tracked threats 10 tracked threats use T1616. - [CyberDakait: Seven Android Trojan Families (GhostBat, cyb3rx, appkjl, godz, d-passive, d-shine, tenxen)…](https://intel.threadlinqs.com/threat/TL-2026-4625) — high — 2026-10-28 - [MR ROBOT Android Malware-as-a-Service Targeting Indian Bank Customers](https://intel.threadlinqs.com/threat/TL-2026-4615) — high — 2026-10-28 - [Malicious Android Apps (ZloyRAT, RedWing Stealer) Lure Russian Users via Fuel-Price and Drone-Strike Anxiety](https://intel.threadlinqs.com/threat/TL-2026-4586) — medium — 2026-10-28 - [GhostBat RAT (GhostX ecosystem) Android Malware Steals UPI PINs via Fake Traffic Challan / mParivahan SMS…](https://intel.threadlinqs.com/threat/TL-2026-3676) — high — 2026-10-15 - [Mantax Otax: Indonesian Android Malware Combines Ransomware with Spyware Integration](https://intel.threadlinqs.com/threat/TL-2026-2719) — high — 2026-09-09 - [RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutions](https://intel.threadlinqs.com/threat/TL-2026-1478) — high — 2026-07-18 - [Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…](https://intel.threadlinqs.com/threat/TL-2026-1225) — high — 2026-07-11 - [Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committee](https://intel.threadlinqs.com/threat/TL-2026-1110) — critical — 2026-07-05 - [Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…](https://intel.threadlinqs.com/threat/TL-2026-1098) — high — 2026-07-03 - [Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commands](https://intel.threadlinqs.com/threat/TL-2026-0826) — high — 2026-06-16 ## Detection coverage Threadlinqs maintains 8 detection rules mapped to T1616 (SPL 2, KQL 3, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only. 8 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1616 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)