SilentAir has intercepted two-factor authentication codes after diverting its targets’ messages through compromised equipment inside Asian mobile carriers. Enea, a telecommunications software and cybersecurity company, attributes attacks primarily targeting subscribers in Taiwan to the group and assesses, with high confidence, that it is a state actor.
Redirection starts inside the mobile network
Enea named the group SilentAir in its November 11 investigation. The company has been observing unusual activity since early 2025, although a subsequent analysis found suspicious signs dating back further. The attacks came from network nodes at Asian carriers that, under normal circumstances, should not originate them.
The group primarily uses SS7 and, occasionally, Diameter, signaling protocols that mobile networks use to manage calls, messages, and roaming services. SilentAir launches attacks on the IPX interconnection network from equipment it has hijacked at carriers. This position allows it to operate from within telecommunications infrastructure, rather than simply from the victim’s phone.
To divert communications, SilentAir sends the subscriber’s home network an UpdateLocation message, or its Diameter equivalent. The message claims that the compromised equipment is now serving the person’s phone. If the network accepts this indication, calls and SMS messages intended for the subscriber pass through the attacker-controlled node.
Some of these diversions worked. Enea observed that, for certain targets, 2FA codes arrived at the compromised equipment immediately after interception began. The sequence points to attempts to access other accounts linked to those people. However, Enea found no equivalent evidence for voice calls and did not report that any account had been taken over.
Interception accounted for 18.3% of SilentAir’s activity observed by Enea. In an earlier company investigation, the proportion for surveillance companies generating most signaling attacks was 2.1%. Some targets were high-profile political and government figures; in rare cases, equipment from several countries collaborated in attacks against the same person, a pattern Enea interprets as evidence of a common controller.
Waves of activity, invisible SMS messages, and targets across several continents
SilentAir’s activity appears in bursts separated by periods of inactivity that can last months or longer. In one wave, attacks can range from one or a few subscribers to several thousand over the course of a month. Taiwan is the group’s main focus, but targets also appear in other countries and territories in East and Southeast Asia, as well as in cases in East Africa, Central Asia, the Middle East, and Europe.
Enea identified sources associated with SilentAir in at least six Asian countries. The company did not disclose the names of the countries, carriers, or affected people; in some countries, it detected sources at more than one carrier. It also warned that subscribers using the compromised network itself may have been targeted, although Enea could not observe that traffic.
Another prominent part of the operation is silent SMS messages sent at scale, especially to Taiwanese subscribers. These are messages that the phone does not display or announce. During the day, most were directed to subscribers on other networks, including Southeast Asian networks. Enea believes some were used to check whether a diversion had succeeded: if the SMS reached the compromised equipment and not the phone, the attackers could infer that they were also receiving that person’s messages.
Most of these messages were sent at night, and most of the nighttime messages went to people in Taiwan. The purpose of this nighttime activity has not been confirmed. Enea suggests it could serve as a mass check of previous diversions that were still active. The messages contained promotional or motivational phrases resembling spam, often in English; the company believes this text could serve as cover if a carrier removed the silent setting and the recipient saw the message.
The link to China remains a low-confidence assessment
Enea assesses, with low confidence, that SilentAir aligns with China-linked operations. The indicators it cites include the focus on Taiwan, the absence of Chinese targets, and an activity schedule consistent with the working day in the UTC+8 zone, which corresponds to China Standard Time. Attacks began at 9 a.m., nearly stopped on weekends, and slowed down or paused during Chinese holidays.
The company says the combination of targets, tactics, and activity patterns supports its assessment that this is a state actor, but it does not present attribution to China as a firm conclusion. The identities of the carriers and targets have not been made public. Enea did report that it alerted the carriers hosting SilentAir’s sources and that the activity has been disrupted for now; the group could return.
The investigation also describes the difficulties in confirming how the attacks had been carried out. Initially, the compromised nodes handled tracking messages for diverted subscribers in an unusual and inconsistent way. This left two possibilities: someone was spoofing the signaling addresses of those networks from outside, or equipment inside the networks had been taken over. Enea confirmed the latter after observing a carrier’s equipment sending and receiving attack commands.
Detection and blocking were not straightforward: Enea says the attackers had a thorough understanding of mobile networks and their signaling defenses. After containing the attacks, it found traces of unauthorized access, but could not analyze the malware it believes SilentAir used. The company also does not know whether the affected carriers have cleaned up the compromised equipment.
Liminal Panda, a second activity on mobile networks
Enea’s report also covers Liminal Panda, a separate group whose relationship with SilentAir has not been confirmed. At several carriers, SilentAir attacks coincided with a known Liminal Panda infection; at other times, there were no signs of coordination. Both operated in the same part of Asia, but Enea does not attribute a known interest in Taiwan to Liminal Panda.
Since the first quarter of 2026, Enea’s GTP firewall has detected and blocked GTPDoor backdoor traffic at several customer carriers. The company counted several hundred covert communication attempts with command-and-control servers. It estimates that it found infections or strong indicators at between five and ten carriers, and believes the actual number could reach several dozen, particularly in Asia, Africa, and Latin America.
GTPDoor is a backdoor that hides commands inside GTP-C, the protocol that establishes mobile data connections. Enea also found evidence of a new version that uses GTP-U, the part of GTP that carries user data. This traffic is harder to inspect and, according to the company, the new version appears to serve mainly as a backup.
The update expands Liminal Panda’s options for concealment: GTP-U carries much more traffic than GTP-C and is also used in 5G, while GTP-C is used from 2G to 4G. Enea does not claim that the two groups are one and the same. Its assessment is that they could be connected, but the evidence is insufficient to link them.
Enea calls for coordinated defenses across protocols
For carriers, Enea recommends going beyond basic signaling security measures and treating all of IPX as untrusted. It also proposes deploying GTP-C and GTP-U firewalls configured to share data with SS7 and Diameter defenses; monitoring signaling protocols within their own networks; and integrating these controls with general IT security.
The company argues that the observed techniques could be reused by other attackers. Enea says it alerted the carriers hosting SilentAir’s sources and helped customers remove Liminal Panda activity. For now, both operations have been disrupted; Enea’s warning is that the conditions for them or other actors to return remain in place.
Sources: SecurityWeek, The Hacker News, Infosecurity Magazine, Enea
