T1643 Generate Traffic from Victim

Activity timeline

T1643 first appeared in tracked threats on 2026-02-24 and was most recently reported on 2026-10-09. The busiest month was 2026-07 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1643 Generate Traffic from Victim is catalogued by MITRE ATT&CK under the Impact (Mobile) tactic in the Mobile matrix. Threadlinqs maps 10 of 2756 tracked threats (0.4%) to it; by severity that is 7 high, 3 medium.

Threats that use T1643 most often also use T1426 System Information Discovery (8 threats), T1406 Obfuscated Files or Information (6 threats), T1407 Download New Code at Runtime (6 threats), T1437 Application Layer Protocol (6 threats), T1418 Software Discovery (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

1 tracked threat actor appear in the threats that use T1643; the most frequent are MoYu Group (2).

Mitigations

MITRE ATT&CK lists 1 mitigation for T1643.

• M1011 User Guidance

Threat actors using it

• MoYu Group 2

Tracked threats

10 tracked threats use T1643.

• Midnight Mimosa: Low-cost MediaTek Android phones ship with firmware-level ad-fraud and residential proxy…high2026-10-09
• First Malware Built Specifically for Car Head Units (DoFun TWCore Update-Chain Abuse) Fuels BadBox Botnethigh2026-08-25
• JarService/Zhima Multi-Stage Android Malware Targets DoFun Automotive Head Units, Linked to BADBOX Botnethigh2026-08-22
• Aftercall: Android Adware Campaign Abuses Overlay/Full-Screen Permissions to Bombard Users with Post-Call Adsmedium2026-07-27
• Albiriox Android Banking RAT-as-a-Service and the Barcode Scanner Play Store Supply-Chain Compromise…medium2026-07-24
• "BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platformhigh2026-07-22
• Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Playhigh2026-07-02
• Android.MagicAd Trojan Floods Devices with Ads via Xiaomi GetApps, Samsung Galaxy Store, and Preinstalled…medium2026-06-09
• NGate Android NFC Relay Malware Variant - Trojanized HandyPay Banking App Campaign Targeting Brazil…high2026-04-22
• SURXRAT Android RAT — LLM Module Downloads from Hugging Face, MaaS via Telegram, ArsinkRAT Evolutionhigh2026-02-24

Detection coverage

Threadlinqs maintains 9 detection rules mapped to T1643 (SPL 2, KQL 4, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only.