APT41__2019__MESSAGETAP_Who_s_Reading_Your_Text_Messages.pdf

FireEye Mandiant discovered MESSAGETAP, a sophisticated 64-bit ELF malware deployed by APT41 against telecommunications SMSC servers to monitor and capture SMS content and metadata. The malware parses network traffic (SCTP, SCCP, TCAP), uses XOR-decoded configuration files listing IMSIs, phone numbers and keywords to filter targets, and stores encoded results to files for later theft; the report also links the activity to CDR harvesting, provides detection names and an example sample.