An organization's mobile device inventory recently provided notification that a zero-day vulnerability was identified in the code used to control the baseband of the devices. The device manufacturer…

The baseband processor runs on separate firmware that is not erased during a standard factory reset of the application OS partition, so persistent apps that survive wiping and resist uninstallation are consistent with unauthorized firmware installed at the baseband level. Overseas travel exposes devices to rogue base stations that can exploit baseband zero-day vulnerabilities to push modified firmware over cellular signaling channels without user interaction. Disabling OTA updates prevents further malicious firmware pushes, and disabling carrier roaming via MDM removes the cellular vector that rogue foreign towers use to reach the device until the manufacturer patch is available.

Applications installed through a spear-phishing email reside in the standard OS user partition and are removed by a factory reset, which directly contradicts the observation that the applications persist after wiping.

Standard monitoring applications downloaded by an attacker are stored in the OS application layer and would not survive a full factory reset, making this explanation inconsistent with the reported persistence behavior.

An improperly encoded emergency broadcast message could exploit a parsing vulnerability to execute arbitrary code, but this vector does not produce persistent user-visible applications that survive a device wipe and cannot be uninstalled.