T1633.001 System Checks

Activity timeline

T1633.001 first appeared in tracked threats on 2026-04-10 and was most recently reported on 2026-10-28. The busiest month was 2026-10 with 6 reports, and 12 of the 12 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1633.001 System Checks is catalogued by MITRE ATT&CK under the Defense Evasion (Mobile) tactic in the Mobile matrix, as a sub-technique of T1633 Virtualization/Sandbox Evasion. Threadlinqs maps 12 of 3302 tracked threats (0.4%) to it; by severity that is 11 high, 1 medium.

Threats that use T1633.001 most often also use T1417.002 GUI Input Capture (9 threats), T1660 Phishing (9 threats), T1407 Download New Code at Runtime (8 threats), T1426 System Information Discovery (8 threats), T1516 Input Injection (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

2 tracked threat actors appear in the threats that use T1633.001; the most frequent are GoldFactory (1), Intellexa Consortium (1).

Threat actors using it

• GoldFactory 1
• Intellexa Consortium 1

Tracked threats

12 tracked threats use T1633.001.

• MR ROBOT Android Malware-as-a-Service Targeting Indian Bank Customershigh2026-10-28
• GoldFactory Android/iOS banking trojan campaign impersonating tax officers across Indonesia, Thailand and…high2026-10-21
• Vultur Android Banking Malware Expands Capabilities via Brunhilda Dropper (Hybrid SMS + Phone Call Social…high2026-10-16
• Hirudo Android Banking Trojan Replaces Indonesian Banking Apps with Patched Copies and Relays Play Integrity…high2026-10-14
• Malicious PDF Reader on Google Play (10,000+ installs) Delivers Anatsa (TeaBot) Banking Trojanhigh2026-10-09
• Crypter-as-a-Service Obfuscation Enabling Undetectable Android/Mobile Malware (ASD-led Advisory "Digital…high2026-10-07
• RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs…high2026-09-20
• Mass Phishing Operation Abuses Fast-Flux DNS to Evade Detection (Yalishanda / ShadowRelay)high2026-09-15
• Copybara Android RAT Delivered via Fake N26 Support Vishing Callshigh2026-08-01
• Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Playhigh2026-07-02
• Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…medium2026-06-09
• Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer)high2026-04-10

Detection coverage

Threadlinqs maintains 12 detection rules mapped to T1633.001 (SPL 4, KQL 4, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.

Parent technique

T1633 Virtualization/Sandbox Evasion — 5 tracked threats at the technique level.