Security Experts:

Connect with us

Hi, what are you looking for?



Chinese Cyberspies Use New Malware to Intercept SMS Traffic at Mobile Operators

A newly discovered piece of malware has been used by a China-linked threat group to spy on SMS traffic as it passes through the servers of telecommunications companies, FireEye reported on Thursday.

A newly discovered piece of malware has been used by a China-linked threat group to spy on SMS traffic as it passes through the servers of telecommunications companies, FireEye reported on Thursday.

The new malware, dubbed MESSAGETAP, has been used by a Chinese threat actor tracked by FireEye as APT41. The group has been active since at least 2012 and it has been involved in both espionage and financially-motivated operations.

MESSAGETAP was discovered earlier this year by the cybersecurity firm during an investigation at a mobile network operator. FireEye described the malware as a 64-bit ELF data miner that targets Linux servers used as Short Message Service Center (SMSC) servers, which are responsible for routing SMS messages to the intended recipient.

Once it infects a server, the malware can monitor all network connections in an effort to identify and extract SMS messages. MESSAGETAP can intercept not only the content of SMS messages, but also IMSI numbers and the phone numbers of both the sender and the recipient.

According to FireEye, MESSAGETAP is accompanied by two .txt configuration files that the attackers use to tell the malware which messages should be exfiltrated.

The files contain lists of IMSI numbers, phone numbers and keywords. If an IMSI or phone number that is of interest to the hackers passes through the targeted mobile operator’s servers, the content of the message is saved to a local CSV file that the attackers can retrieve later. Similarly, if a message contains one of the keywords, it will be saved to a CSV file.

FireEye said the configuration files contained many phone numbers and IMSI numbers. The keywords targeted by the attackers have been described by the cybersecurity firm as “terms of geopolitical interest to Chinese intelligence collection.” These keywords include the names of military and intelligence organizations, political leaders, and political movements that oppose the Chinese government.

“In addition to MESSAGETAP SMS theft, FireEye Mandiant also identified the threat actor interacting with call detail record (CDR) databases to query, save and steal records during this same intrusion,” FireEye said in a blog post. “The CDR records corresponded to foreign high-ranking individuals of interest to the Chinese intelligence services. Targeting CDR information provides a high-level overview of phone calls between individuals, including time, duration, and phone numbers.”

FireEye is aware of four telecommunications organizations targeted this year by APT41, which has also been spotted attacking medical entities. The group also recently targeted a research university in the United States.

The company has also observed four other telecoms firms targeted in 2019 by other threat groups believed to be sponsored by the Chinese government.

“The use of MESSAGETAP and targeting of sensitive text messages and call detail records at scale is representative of the evolving nature of Chinese cyber espionage campaigns observed by FireEye,” the cybersecurity company said. “APT41 and multiple other threat groups attributed to Chinese state-sponsored actors have increased their targeting of upstream data entities since 2017.”

Related: The United States and China – A Different Kind of Cyberwar

Related: China Believes Its Cyber Capabilities Lag Behind US: Pentagon

Related: China-Linked ‘Thrip’ Cyberspies Continue Attacks on Southeast Asia

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


Artificial intelligence is competing in another endeavor once limited to humans — creating propaganda and disinformation.

Malware & Threats

Norway‎-based DNV said a ransomware attack on its ship management software impacted 1,000 vessels.

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...


Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.


The UK’s NCSC has issued a security advisory to warn about spearphishing campaigns conducted by two unrelated Russian and Iranian hacker groups.


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Malware & Threats

Cybercrime in 2017 was a tumultuous year "full of twists and turns", with new (but old) infection methods, a major return to social engineering,...