Threat Signal ReportMESSAGETAP/APT41 Activity
Description
What is the issue specifically?
The FortiGuard Labs SE team is aware of a new state
sponsored attack dubbed "MESSAGETAP" discovered by researchers at FireEye.
MESSAGETAP is an infostealer that can steal SMS text messages, IMSI numbers and
specific keywords for later exfiltration. This new APT is assigned the number
41, which follows the nomenclature of FireEye's naming convention. FireEye has
attributed APT41 to China.
How was this
discovered?
FireEye states this sample was discovered in 2019
during an investigation of an unnamed telecom provider.
What is the threat
specifically?
MESSAGETAP is a 64-bit ELF file that is designed to
exfiltrate information from servers hosting SMS services, IMSI data and any other
specific keywords targeted by the attackers. The malware looks for the creation
of two specific text files keyword_parm.txt and parm.txt on the targeted
machine and will check the contents of these files every 30 seconds. Contained within these text files is logged
data that contains IMSI numbers, which is a number that uniquely identifies
every individual caller of a mobile network. It is stored in a 64-bit field and
is sent from device to the carrier once a connection is established. Additional
data stored in these log files are phone numbers and specific keyword data. The
files are then loaded into memory and deleted off the disk once accessed.
Outside of the logging of phone numbers connected to the network, it will also register
calls made from devices as well.
MESSAGETAP will then utilize the open source
libpcap library to intercept all targeted traffic to and from the server, where
it will then exfiltrate the targeted variables off the machine for later
analysis. Finally, it will seek to intercept SMS messages checking against a
blacklist of IMSI numbers alongside using specific keywords to determine if the
SMS messages contain specific text that are hostile to the Chinese government.
If these keywords are found, the file will be logged elsewhere to the system
for later exfiltration.
How widespread
were these attacks?
Spread is limited to targeted attacks in the
telecom vertical.
Are these recent
attacks?
According to FireEye, this attack was first
discovered in August of 2019.
What operating
systems are affected?
Linux based systems, specifically those acting as Short
Message Service Center (SMSC) servers.
What is the status
of AV and IPS coverage?
Fortinet customers running the latest definition set are protected against this threat with the following AV signature:
ELF/Messagetap.A!tr
Any suggested
recommendations or mitigations?
The FortiGuard SE team recommends that all AV and
IPS definitions are kept up to date on a continual basis, and to always
maintain a proactive patching routine when vendor updates are available. If it
is deemed that patching is not feasible at this time, it is recommended that a
risk assessment is conducted to determine additional mitigation safeguards
within an environment.
Also, the FortiGuard SE and FortiGuard Labs teams are
proactively monitoring the threat landscape for the latest announcements made
by researchers through the responsible disclosure process or elsewhere to
ensure that customers are protected with latest mitigation strategy and
signature updates affecting the threat ecosystem.
