Virtual Event Today: Supply Chain Security Summit - Register Now

Security Experts:

Connect with us

Hi, what are you looking for?



Chinese Cyberspies Use New Malware to Intercept SMS Traffic at Mobile Operators

A newly discovered piece of malware has been used by a China-linked threat group to spy on SMS traffic as it passes through the servers of telecommunications companies, FireEye reported on Thursday.

A newly discovered piece of malware has been used by a China-linked threat group to spy on SMS traffic as it passes through the servers of telecommunications companies, FireEye reported on Thursday.

The new malware, dubbed MESSAGETAP, has been used by a Chinese threat actor tracked by FireEye as APT41. The group has been active since at least 2012 and it has been involved in both espionage and financially-motivated operations.

MESSAGETAP was discovered earlier this year by the cybersecurity firm during an investigation at a mobile network operator. FireEye described the malware as a 64-bit ELF data miner that targets Linux servers used as Short Message Service Center (SMSC) servers, which are responsible for routing SMS messages to the intended recipient.

Once it infects a server, the malware can monitor all network connections in an effort to identify and extract SMS messages. MESSAGETAP can intercept not only the content of SMS messages, but also IMSI numbers and the phone numbers of both the sender and the recipient.

According to FireEye, MESSAGETAP is accompanied by two .txt configuration files that the attackers use to tell the malware which messages should be exfiltrated.

The files contain lists of IMSI numbers, phone numbers and keywords. If an IMSI or phone number that is of interest to the hackers passes through the targeted mobile operator’s servers, the content of the message is saved to a local CSV file that the attackers can retrieve later. Similarly, if a message contains one of the keywords, it will be saved to a CSV file.

FireEye said the configuration files contained many phone numbers and IMSI numbers. The keywords targeted by the attackers have been described by the cybersecurity firm as “terms of geopolitical interest to Chinese intelligence collection.” These keywords include the names of military and intelligence organizations, political leaders, and political movements that oppose the Chinese government.

“In addition to MESSAGETAP SMS theft, FireEye Mandiant also identified the threat actor interacting with call detail record (CDR) databases to query, save and steal records during this same intrusion,” FireEye said in a blog post. “The CDR records corresponded to foreign high-ranking individuals of interest to the Chinese intelligence services. Targeting CDR information provides a high-level overview of phone calls between individuals, including time, duration, and phone numbers.”

FireEye is aware of four telecommunications organizations targeted this year by APT41, which has also been spotted attacking medical entities. The group also recently targeted a research university in the United States.

The company has also observed four other telecoms firms targeted in 2019 by other threat groups believed to be sponsored by the Chinese government.

“The use of MESSAGETAP and targeting of sensitive text messages and call detail records at scale is representative of the evolving nature of Chinese cyber espionage campaigns observed by FireEye,” the cybersecurity company said. “APT41 and multiple other threat groups attributed to Chinese state-sponsored actors have increased their targeting of upstream data entities since 2017.”

Related: The United States and China – A Different Kind of Cyberwar

Related: China Believes Its Cyber Capabilities Lag Behind US: Pentagon

Related: China-Linked ‘Thrip’ Cyberspies Continue Attacks on Southeast Asia

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Malware & Threats

Threat actors are increasingly abusing Microsoft OneNote documents to deliver malware in both targeted and spray-and-pray campaigns.


Iranian APT Moses Staff is leaking data stolen from Saudi Arabia government ministries under the recently created Abraham's Ax persona

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.