MalwareExploits 2 CVEs

CATana

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2025-48618Lockscreen browser launch via hostile SIM in Android

Для своего исследования специалисты создали тулкит CATana, который позволяет проверять, какие AT-команды SIM-карта может передавать модему, и к каким последствиям это приводит.

via xakepxakep.ru

CVE-2026-57550Open SIM AT Interface in Qualcomm-Based Cellular Modules and Phones

via xakepxakep.ru

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

Наиболее опасную атаку специалисты продемонстрировали на примере коммерческой зарядной станции Autel с модулем Quectel EC25-AFX. В этом случае исследователи эксплуатировали уязвимость инъекции команда в Linux-среде модема и успешно добились выполнения произвольного кода.

T1203Exploitation for Client ExecutionEvidence1

On an AUTEL EV charger built around a Quectel EC25-AFX module, SIM-issued commands triggered a command injection flaw in the modem’s Linux-based application processor, giving the researchers code execution on the cellular module.

Collection

1 technique

T1005Data from Local SystemEvidence1

Against a Quectel EG25-G modem, the team combined a malicious symbolic link with commands sent from the SIM to email a targeted file from the device to a server they controlled.

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

Against a Quectel EG25-G modem, the team combined a malicious symbolic link with commands sent from the SIM to email a targeted file from the device to a server they controlled.

Impact

1 technique

T1498Network Denial of ServiceEvidence1

The testing uncovered four vulnerabilities and produced demonstrations involving code execution, file theft, denial of service, and forced network downgrades.

Other

1 technique

T1562.010Downgrade AttackEvidence1

An OPPO Reno14 F 5G accepted 198 AT commands and variants through the SIM interface, including commands that could power off the phone, stop its modem, or force the connection onto 2G.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

xakepNews

Aug 14, 2026

Вредоносная SIM-карта может выполнить код на устройстве и похитить данные - Хакер

Research toolkit created to test which AT commands a SIM card can pass to a modem and what security impact this can have.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 2 CVEs

CATana

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2025-48618Lockscreen browser launch via hostile SIM in Android

via xakepxakep.ru

CVE-2026-57550Open SIM AT Interface in Qualcomm-Based Cellular Modules and Phones

via xakepxakep.ru

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

T1203Exploitation for Client ExecutionEvidence1

Collection

1 technique

T1005Data from Local SystemEvidence1

Against a Quectel EG25-G modem, the team combined a malicious symbolic link with commands sent from the SIM to email a targeted file from the device to a server they controlled.

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

Against a Quectel EG25-G modem, the team combined a malicious symbolic link with commands sent from the SIM to email a targeted file from the device to a server they controlled.

Impact

1 technique

T1498Network Denial of ServiceEvidence1

The testing uncovered four vulnerabilities and produced demonstrations involving code execution, file theft, denial of service, and forced network downgrades.

Other

1 technique

T1562.010Downgrade AttackEvidence1

An OPPO Reno14 F 5G accepted 198 AT commands and variants through the SIM interface, including commands that could power off the phone, stop its modem, or force the connection onto 2G.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

xakepNews

Aug 14, 2026

Вредоносная SIM-карта может выполнить код на устройстве и похитить данные - Хакер

Research toolkit created to test which AT commands a SIM card can pass to a modem and what security impact this can have.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.