H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

MESSAGETAP

[MESSAGETAP](https://attack.mitre.org/software/S0443) is a data mining malware family deployed by [APT41](https://attack.mitre.org/groups/G0096) into telecommunications networks to monitor and save SMS traffic from specific phone numbers, IMSI numbers, or that contain specific keywords. (Citation: FireEye MESSAGETAP October 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[MESSAGETAP](https://attack.mitre.org/software/S0443) is a data mining malware family deployed by [APT41](https://attack.mitre.org/groups/G0096) into telecommunications networks to monitor and save SMS traffic from specific phone numbers, IMSI numbers, or that contain specific keywords. (Citation: FireEye MESSAGETAP October 2019)

Labels

malware
9 recorded

Relationships

uses
from APT41
Group
uses
to Archive via Custom Method
Technique
uses
to Automated Collection
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Local Data Staging
Technique
uses
to Network Sniffing
Technique
uses
to System Network Connections Discovery
Technique
2 external

References

mitre-attack
S0443
open
FireEye MESSAGETAP October 2019
https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance