Information can be so valuable that people can go to great length to obtain it. Even if it needs stealing.
APT41, one of China’s state-backed hacking groups, has developed a malware to steal SMS messages, IMSI numbers and specific keywords from telecommunication companies, that according to a research from cybersecurity vendor FireEye.
On its blog post, the malware in question is called MESSAGETAP.
The operations have been commencing since at least 2012. And MESSAGETAP that is one of the tools used, was discovered by the researchers on a Short Message Service Center (SMSC) server being used by a telecommunication firm to route SMS messages to intended recipients.
"APT41’s operations have included state-sponsored cyber espionage missions as well as financially-motivated intrusions."
Besides extracting the content of SMS messages, the malware can also collect the source and destination phone numbers of targeted individuals, the mobile subscriber identity numbers, and data from call detail record (CDR) databases.
The malware works by first sniffing SMS traffic and stealing them if the contents contain special keywords. In this case, the keywords include those related with geopolitical interest, and when the messages were being sent from or to particular phone numbers, or specific devices with unique IMSI numbers.
FireEye didn’t disclose the targets of this espionage campaign, but said that four telecommunication operators were already infected with MESSAGETAP in 2019.
APT41, according to another blog post from FireEye, "is unique among tracked China-based actors in that it leverages non-public malware typically reserved for espionage campaigns in what appears to be activity for personal gain."
While state-sponsored hackers have cyber espionage missions as their primary objectives, the APT41 is also known for conducting side operations by using ransomware against its targets for personal profit.
"The group has established and maintained strategic access to organizations in the healthcare, high-tech, and telecommunications sectors. APT41 operations against higher education, travel services, and news/media firms provide some indication that the group also tracks individuals and conducts surveillance." the post continued.
APT41 uses a wide range of hacking tools and techniques, and claims itself to be the "Swiss Army knife" of data theft, capable of running extortion campaigns, and conducting surveillance on anyone Beijing is interested in.
And with MESSAGETAP, another tool in the cyberwar originated form China has been uncovered. This is just another evidence of how state-sponsored hackers can use increasingly sophisticated prowess to conduct espionage.
"The use of MESSAGETAP and targeting of sensitive text messages and call detail records at scale is representative of the evolving nature of Chinese cyber espionage campaigns," FireEye said.
The hacking campaign also shows the risk associated with transmitting sensitive data via SMS, which doesn't use encryption and also prone to hijacks.
