MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata. 2
tool
MESSAGETAP S0443
- Type
- malware
- Platform
- Linux
- Created
- 11 May 2020
- Last modified
- 25 April 2025
MESSAGETAP is a data mining malware family deployed by APT41 into telecommunications networks to monitor and save SMS traffic from specific phone numbers, IMSI numbers, or that contain specific keywords. [1]
8
Techniques38th pct
4
Tactics32nd pct
1
Threat groupunranked
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference S0443
After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server. 3
Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk. 4
MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.5
MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.6
MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.7
Standing S0443
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques838th pct
38th percentile · 62% of 825 ATT&CK software entries have more Enterprise techniques.
Tactics432nd pct
32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.
Threat group161% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns085% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique14.5med30th pct
30th percentile · 70% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique8med
Detection coverage S0443
123 distinct rules cover the 8 techniques recorded for this tool. The 124 technique-to-rule mappings resolve to 123 distinct rules, because one rule can cover several techniques. 84 Sigma · 39 Splunk.
7 covered by at least one rule1 with no coverage123 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org