A spying group has compromised equipment inside Asian mobile operators to divert selected subscribers’ calls and texts, with successful text interception observed mainly against targets in Taiwan, Enea said in a report covered by The Hacker News on November 13. For some targets, Enea observed two-factor authentication codes being intercepted immediately after the diversion, pointing to attempts to enter accounts registered to those people.
The Stockholm-based telecom and cybersecurity software company named the group SilentAir this week and identified attack sources in at least six Asian countries. It assessed with high confidence that the group is a state-level actor, while assigning low confidence to a possible connection to China.
Targets included political and government VIPs in their own countries. Outside Taiwan, most were subscribers on other Southeast and East Asian networks, with occasional targeting in East Africa, Central Asia, the Middle East and Europe. Subscribers of the compromised operators may also have been targeted, but Enea lacked visibility into that traffic.
Enea notified operators hosting the attack sources and said SilentAir has been disrupted for now, although it could return; whether those operators have removed the compromised equipment remains unclear.
How the diversions worked
Mobile operators exchange signaling messages—the instructions used to route calls and texts and support roaming—through protocols called SS7 and Diameter. These messages cross the IPX, a shared network built on considerable trust between operators. SilentAir used equipment inside compromised operators to send attacks into that network.
To intercept communications, the group sent a subscriber’s home network an SS7 UpdateLocation message, or its Diameter equivalent, claiming the compromised equipment was now serving that person’s phone. If the home network accepted the claim, it would redirect calls and texts to the attackers.
Enea observed successful text interception, including authentication codes, though it reported neither comparable evidence of intercepted voice calls nor confirmed account takeovers. Interception represented 18.3% of the SilentAir attacks it observed, compared with 2.1% for a typical surveillance company in Enea’s earlier research. Such companies account for most signaling attacks.
The activity came in bursts, ranging from one or a few subscribers to several thousand over a month, separated by gaps lasting several months or longer. In rare cases, equipment in several countries coordinated against political or government targets, which Enea interpreted as evidence of a single controller.
Enea began tracking unusual attacks in early 2025, mostly over SS7 and sometimes Diameter, originating from Asian operators that would not normally generate such activity. Later analysis uncovered earlier suspicious activity. The report names neither the countries and operators hosting the equipment nor individual targets; some countries had more than one compromised operator.
The researchers initially considered two explanations for the networks’ inconsistent handling of follow-up messages: an outsider forging their signaling addresses, or compromised equipment inside each network. They then observed equipment within one operator both sending and receiving attack commands. Its behavior matched SilentAir sources elsewhere, confirming the internal-compromise explanation.
The attackers’ knowledge of mobile networks and signaling defenses initially made detection and blocking difficult. After containing the attacks, Enea recovered traces of unauthorized access but could not analyze the malware it believes the group used.
Silent messages checked access
SilentAir also sent silent SMS messages on a very large scale, mainly to Taiwanese subscribers. These texts produce no display or alert on the recipient’s phone.
During the day, most went to subscribers on other networks, including Southeast Asian networks. Enea believes a principal use was checking whether a diversion had succeeded: a test message arriving at the compromised equipment instead of the subscriber’s phone would confirm that the attackers were receiving the person’s texts.
Most silent messages were sent at night, and most of those targeted Taiwan. Their purpose remains unconfirmed, but Enea suggested they could be bulk checks that earlier diversions were still active, because phones are least likely to register their real location again overnight.
The messages contained spam-like motivational or promotional text, often in English. Enea believes this provided cover if an operator stripped the silent setting in transit, making a visible message look like ordinary spam.
China link remains tentative
Enea’s low-confidence China assessment rests partly on SilentAir’s focus on Taiwan and its avoidance of Chinese networks and subscribers. Tracking and interception activity also followed a UTC+8 working day, matching China Standard Time: attacks began at 9 a.m., almost stopped on weekends, and paused or slowed around Chinese holidays.
The company considered a possible connection to Liminal Panda, a group associated with earlier telecom intrusions, but regards that connection as unconfirmed. SilentAir activity overlapped known Liminal Panda infections at several operators, while at other times there was no sign of coordination. Both targeted operators in the same part of Asia, although Liminal Panda has no known Taiwan focus.
Some SilentAir behavior also resembled SCTPE, a little-known Linux trojan that runs in the operating system’s kernel and sends and receives SS7 and Diameter traffic. Singapore’s Infocomm Media Development Authority described the same tool as SIGweaver in a government advisory, saying CrowdStrike identified it on January 21 and linked it to Liminal Panda with moderate confidence.
However, SilentAir responded to messages it had not sent itself, something the known SCTPE program cannot do. Enea also judged SilentAir’s operational security substantially better than Liminal Panda’s.
Separately, Enea said its GTP firewall has detected Liminal Panda activity at several customer operators since the first quarter of 2026. It blocked GTPDoor traffic and observed infections, or strong indications of them, in at least five to 10 operators.
GTPDoor, first documented on February 27, 2024, conceals commands in GTP-C, the protocol used to establish mobile data connections between networks. Enea also found evidence of a new version using GTP-U, which carries users’ data and is harder to inspect. The company believes that version mainly provides a backup channel.
Operators urged to connect their defenses
Enea warned that other attackers could reuse these techniques. Its recommendations address mobile operators: deploy firewalls for both GTP-C and GTP-U, and configure them to exchange information with SS7 and Diameter firewalls.
Operators should also go beyond basic industry signaling-security recommendations, treat the entire IPX as untrusted, detect signaling attacks within their own networks, and connect signaling defenses with their wider IT security operations, Enea said.
