Skip to content
attack.paths
Iniciar sesión
← RegistryDossier · 5 steps · 4 edges

IMSI catcher → force 2G downgrade → SMS / call intercept

Operate a rogue base station in the target area. Phones associate; force fallback to 2G where no mutual auth is required. Intercept SMS OTPs, sniff voice calls, push notifications fail silently.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target user's phone still allows 2G fallback (most carriers haven't disabled it). Attacker has SDR / commercial IMSI catcher in physical range.

§ Steps

  1. 01
    Replay captured OTP for SaaS / banking ATOCredential Access
    W-MFA-BYPASS— MFA Bypass
  2. 02
    Stand up rogue eNB / gNB (srsRAN / OsmocomBB)Resource Development
    T1583— Acquire Infrastructure
  3. 03
    Capture SMS / call trafficCollection
    T1056— Input Capture
  4. 04
    Higher transmit power lures victimsInitial Access
    WIFI-EVIL-TWIN— Evil Twin / Rogue AP
  5. 05
    Force 2G fallbackCredential Access
    5G-IMSI-CATCHER— IMSI Catcher / Stingray

§ References

§ Frequently asked

What is the "IMSI catcher → force 2G downgrade → SMS / call intercept" attack path?
Operate a rogue base station in the target area. Phones associate; force fallback to 2G where no mutual auth is required. Intercept SMS OTPs, sniff voice calls, push notifications fail silently. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Replay captured OTP for SaaS / banking ATO (W-MFA-BYPASS) — a credential access primitive. Assumed environment: target user's phone still allows 2G fallback (most carriers haven't disabled it).
What is the final impact of this kill-chain?
The final step lands on Force 2G fallback (5G-IMSI-CATCHER), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers