Dubbed "MessageTap," the backdoor malware is a 64-bit ELF data miner that has recently been discovered installed on a Linux-based Short Message Service Center (SMSC) server of an unnamed telecommunications company.
According to a recent report published by FireEye's Mandiant firm, MessageTap has been created and used by APT41, a prolific Chinese hacking group that carries out state-sponsored espionage operations and has also been found involved in financially motivated attacks.
In mobile telephone networks, SMSC servers act as a middle-man service responsible for handling the SMS operations by routing messages between senders and recipients.
Since SMSes are not designed to be encrypted, neither on transmitting nor on the telecom servers, compromising an SMSC system allows attackers to monitor all network connections to and from the server as well as data within them.
How Does MessageTap Malware Work?
MessageTap uses the libpcap library to monitor all SMS traffic and then parses the content of each message to determine IMSI and phone numbers of the sender and the recipient.
According to the researchers, hackers have designed MessageTap malware to filter and only save messages:
- sent or received by specific phone numbers,
- containing certain keywords, or
- with specific IMSI numbers.
For this, MessageTap relies on two configuration files provided by attackers — keyword_parm.txt and parm.txt — that contain a list of targeted phone numbers, IMSI numbers, and keywords linked to "high-ranking individuals of interest to the Chinese intelligence services."
"Both files are deleted from disk once the configuration files are read and loaded into memory. After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the server," the researchers said in its report released today.
"The data in keyword_parm.txt contained terms of geopolitical interest to Chinese intelligence collection."
If it finds an SMS message text of interest, the malware XORs its content and saves it to CSV files for later theft by the threat actor.
According to the researchers, "the risk of unencrypted data being intercepted several layers upstream in their cellular communication chain" is especially "critical for highly targeted individuals such as dissidents, journalists, and officials that handle highly sensitive information."
Besides this, the APT41 hacking group has also been found stealing call detail records (CDR) corresponded to high-ranking foreign individuals during this same intrusion, exposing metadata of calls, including the time of the calls, their duration, and the source and destination phone numbers.
Chinese hackers targeting telecommunications companies isn't new. In this year itself, the APT41 hacking group targeted at least four telecommunications entities, and separate Chinese-suspected state-sponsored groups also observed hitting four additional telecommunications organizations.
According to the FireEye researchers, this trend will continue and more such campaigns will be discovered soon, and therefore to mitigate a degree of risks, targeted organisations should consider deploying an appropriate communication program that enforces end-to-end encryption.
