Chinese Cyberspies Use New Malware to Intercept SMS Traffic at Mobile Operators

A newly discovered piece of malware has been used by a China-linked threat group to spy on SMS traffic as it passes through the servers of telecommunications companies, FireEye reported on Thursday.

The new malware, dubbed MESSAGETAP, has been used by a Chinese threat actor tracked by FireEye as APT41. The group has been active since at least 2012 and it has been involved in both espionage and financially-motivated operations.

MESSAGETAP was discovered earlier this year by the cybersecurity firm during an investigation at a mobile network operator. FireEye described the malware as a 64-bit ELF data miner that targets Linux servers used as Short Message Service Center (SMSC) servers, which are responsible for routing SMS messages to the intended recipient.

Once it infects a server, the malware can monitor all network connections in an effort to identify and extract SMS messages. MESSAGETAP can intercept not only the content of SMS messages, but also IMSI numbers and the phone numbers of both the sender and the recipient.

According to FireEye, MESSAGETAP is accompanied by two .txt configuration files that the attackers use to tell the malware which messages should be exfiltrated.

The files contain lists of IMSI numbers, phone numbers and keywords. If an IMSI or phone number that is of interest to the hackers passes through the targeted mobile operator’s servers, the content of the message is saved to a local CSV file that the attackers can retrieve later. Similarly, if a message contains one of the keywords, it will be saved to a CSV file.

FireEye said the configuration files contained many phone numbers and IMSI numbers. The keywords targeted by the attackers have been described by the cybersecurity firm as “terms of geopolitical interest to Chinese intelligence collection.” These keywords include the names of military and intelligence organizations, political leaders, and political movements that oppose the Chinese government.

“In addition to MESSAGETAP SMS theft, FireEye Mandiant also identified the threat actor interacting with call detail record (CDR) databases to query, save and steal records during this same intrusion,” FireEye said in a blog post. “The CDR records corresponded to foreign high-ranking individuals of interest to the Chinese intelligence services. Targeting CDR information provides a high-level overview of phone calls between individuals, including time, duration, and phone numbers.”

FireEye is aware of four telecommunications organizations targeted this year by APT41, which has also been spotted attacking medical entities. The group also recently targeted a research university in the United States.

The company has also observed four other telecoms firms targeted in 2019 by other threat groups believed to be sponsored by the Chinese government.

“The use of MESSAGETAP and targeting of sensitive text messages and call detail records at scale is representative of the evolving nature of Chinese cyber espionage campaigns observed by FireEye,” the cybersecurity company said. “APT41 and multiple other threat groups attributed to Chinese state-sponsored actors have increased their targeting of upstream data entities since 2017.”

Related: The United States and China – A Different Kind of Cyberwar

Related: China Believes Its Cyber Capabilities Lag Behind US: Pentagon

Related: China-Linked ‘Thrip’ Cyberspies Continue Attacks on Southeast Asia