T1624 Event Triggered Execution

Activity timeline

T1624 first appeared in tracked threats on 2026-03-07 and was most recently reported on 2026-08-05. The busiest month was 2026-07 with 12 reports, and 19 of the 19 threats were reported in the twelve months to 2026-08.

How adversaries use it

T1624 Event Triggered Execution is catalogued by MITRE ATT&CK under the Persistence (Mobile) tactic in the Mobile matrix. Threadlinqs maps 19 of 2623 tracked threats (0.7%) to it; by severity that is 2 critical, 14 high, 2 medium, 1 low.

Threats that use T1624 most often also use T1417 Input Capture (17 threats), T1437 Application Layer Protocol (17 threats), T1426 System Information Discovery (14 threats), T1646 Exfiltration Over C2 Channel (14 threats), T1660 Phishing (14 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

Mitigations

MITRE ATT&CK lists 1 mitigation for T1624.

• M1006 Use Recent OS Version

Tracked threats

19 tracked threats use T1624.

• Octagon Android RAT — Fake Bahrain Civil Defense App Targets Mobile Endpoints via Multi-Stage Payloadcritical2026-08-05
• Inside the Underground Business of the BTMOB Android RAT Malware-as-a-Servicehigh2026-08-03
• Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal…high2026-08-03
• Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emergeshigh2026-07-29
• Research: Android ML Malware Detectors Collapse Without Context-Stage Analysis (PRAXIS vs. Drebin, MalScan…low2026-07-29
• Aftercall: Android Adware Campaign Abuses Overlay/Full-Screen Permissions to Bombard Users with Post-Call Adsmedium2026-07-27
• SparkKitty: Cross-Platform iOS/Android Stealer Using OCR to Harvest Crypto Wallet Seed Phrases from App…high2026-07-27
• Albiriox Android Banking RAT-as-a-Service and the Barcode Scanner Play Store Supply-Chain Compromise…medium2026-07-24
• "BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platformhigh2026-07-22
• RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutionshigh2026-07-18
• Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking…high2026-07-11
• Glitch SPY Android RAT Distributed via Fake Polish Rental App ("Tutaj Dom") Using Brokewell Loaderhigh2026-07-10
• European Parliament Member Investigating Pegasus Spyware Hacked With Pegasus (PWNYOURHOME Zero-Click Exploit…critical2026-07-03
• Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member…high2026-07-03
• Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Playhigh2026-07-02
• BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…high2026-05-27
• TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL for Covert C2 Targeting Banking and Crypto Users…high2026-05-11
• NGate Android NFC Relay Malware Variant - Trojanized HandyPay Banking App Campaign Targeting Brazil…high2026-04-22
• Trojanized Red Alert Rocket Warning App — Arid Viper Mobile Spyware Campaign Targeting Israeli Usershigh2026-03-07

Detection coverage

Threadlinqs maintains 19 detection rules mapped to T1624 (SPL 6, KQL 5, Sigma 8). Rule content is available to Blue tier accounts and above; this page shows counts only.

Sub-techniques

• T1624.001 Broadcast Receivers — 10 tracked threats