Sunday, July 21, 2024

Messagetap – A New Malware Used by APT41 Hacker Group to Spy on SMS Traffic

A new malware dubbed “Messagetap” designed to monitor and record SMS traffic of certain phone numbers, IMSI numbers, and based on keywords for subsequent theft.

The new malware was developed by the Chinese APT41 hacker group to deploy in the telecommunications network. The malware was discovered by FireEye during an investigation at a telecommunications network provider.

APT41 is the Chinese state-sponsored hacker group, know for conducting financially motivated operations, the group found to be active at least from 2012.

The Messagetap malware found in a cluster of Linux servers that used for as Short Message Service Center (SMSC) servers. In the telecommunication network, SMSCs operate to store, forward, convert and deliver Short Message Service.

Messagetap Malware

Once this malware get’s installed in a Linux SMSCs, they check for the existence of two files named keyword_parm.txt and parm.txt. These files contain for Messagetap malware.

parm.txt – File contains IMSI numbers and phone numbers to target.

keyword_parm.txt – Contains Keyword list that is read into keywordVec

The configuration files provide the target for malware, keyword_parm.txt contains keywords of geopolitical interest and parm.txt contains two list phoneMap(phone numbers) and imsiMap(IMSI numbers).

Messagetap Flow Diagram Pic: FireEye

The malware installation script tries to read configuration files for every 30 seconds if the configuration files exist they are loaded into memory and files will get deleted.

“Messagetap begins monitoring all network connections to and from the server. It uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP,” reads FireEye report.

The malware extracts the following data from the network

  • SMS message contents
  • The IMSI number
  • The source and destination phone numbers

“The malware searches the SMS message contents for keywords from the keywordVec list, compares the IMSI number with numbers from the imsiMap list, and checks the extracted phone numbers with the numbers in the phoneMap list.”

If the SMS message matches the phone number, IMSI number or keywords they are saved to CSV file by the threat actor.

In addition to Messagetap SMS theft, FireEye also identified the threat actor interacting with call detail record (CDR) databases to query, save and steal records during this same intrusion.

The threat actor group continues to target other organizations such as travel services and healthcare providers beyond telecommunication to steal sensitive details of specific individuals.

Recently researchers discovered a new attack dubbed Simjacker, that can be exploited by sending an SMS containing a specific type of spyware code.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles