MESSAGETAP

MITRE ATT&CK: S0443 View on attack.mitre.org

Aliases: MESSAGETAP

Malware type
spyware
Family
Malware family
Operating systems
linux
Profile updated
2026-07-07 12:41:52

Targeted industries: technology-and-telecommunications

Context

MESSAGETAP is a data mining malware family deployed by APT41 into telecommunications networks to monitor and save SMS traffic from specific phone numbers, IMSI numbers, or that contain specific keywords.

Detection coverage

  • 73 Sigma rules

Malware & tools used

  • File Deletion (attack-pattern)
  • Network Sniffing (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Local Data Staging (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • Archive via Custom Method (attack-pattern)
  • Automated Collection (attack-pattern)
  • File and Directory Discovery (attack-pattern)

Used by threat actors

Reports & references

  • CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
  • pwc.co.uk — Cyber Threats 2019 Retrospect (report)
  • MITRE ATT&CK — G0096 (report)
  • intezer.com — Elf Malware Analysis 101 Linux Threats No Longer An Afterthought (report)
  • Kaspersky — 98440 (report)
  • malpedia.caad.fkie.fraunhofer.de — Elf.Messagetap (report)
  • Mandiant — Cds19 Executive S08 Achievement Unlocked (report)
  • Mandiant — Messagetap Who Is Reading Your Text Messages (report)
  • MITRE ATT&CK — S0443 (report)

External references