SilentAir State-Level Actor Intercepts Calls and SMS via Compromised Mobile Networks
Enea has identified a previously unknown state-level threat actor, SilentAir, actively intercepting phone calls and SMS messages by compromising mobile operator network nodes primarily targeting Taiwan. SilentAir conducts signaling attacks mainly through SS7 and occasionally Diameter protocols to reroute communications through hijacked nodes, exfiltrating subscriber details and tracking locations. Monitoring began in early 2025, revealing multiple Asian countries and other global regions under attack, with high-profile political and government figures as targets. A possibly related group, Liminal Panda, has been exploiting mobile operator interconnect networks with backdoors, though ties between the two groups remain inconclusive.
Detalhes técnicos
SilentAir utilizes hijacked mobile network nodes to conduct SS7 and Diameter signaling attacks that intercept incoming calls and SMS. The group also sends silent SMS messages to verify interception success. The attackers have targeted operators in at least six Asian countries, with some operations extending to East Africa, Central Asia, the Middle East, and Europe. Liminal Panda, active since early 2026, exploits the IPX network using the GTPDoor backdoor to communicate with command-and-control servers.
Attribution
SilentAir is assessed with high confidence as a new state-level actor, suspected with low confidence to have China nexus due to targeting Taiwan, attack times aligned with China work hours, and lack of Chinese targets. Liminal Panda is similarly linked with low confidence to China.
Remediação
Enea has detected and blocked several attempts by Liminal Panda to access operator networks, indicating active defense. Mobile operators should audit for hijacked nodes and secure signaling infrastructure to mitigate such interceptions.
Linha do tempo
-
SilentAir State-Level Actor Intercepts Calls and SMS via Compromised Mobile Networks
ler a análise desta fonte ocultar
Enea has identified a previously unknown state-level threat actor, SilentAir, actively intercepting phone calls and SMS messages by compromising mobile operator network nodes primarily targeting Taiwan. SilentAir conducts signaling attacks mainly through SS7 and occasionally Diameter protocols to reroute communications through hijacked nodes, exfiltrating subscriber details and tracking locations. Monitoring began in early 2025, revealing multiple Asian countries and other global regions under attack, with high-profile political and government figures as targets. A possibly related group, Liminal Panda, has been exploiting mobile operator interconnect networks with backdoors, though ties between the two groups remain inconclusive.
Technical Details
SilentAir utilizes hijacked mobile network nodes to conduct SS7 and Diameter signaling attacks that intercept incoming calls and SMS. The group also sends silent SMS messages to verify interception success. The attackers have targeted operators in at least six Asian countries, with some operations extending to East Africa, Central Asia, the Middle East, and Europe. Liminal Panda, active since early 2026, exploits the IPX network using the GTPDoor backdoor to communicate with command-and-control servers.
Attribution
SilentAir is assessed with high confidence as a new state-level actor, suspected with low confidence to have China nexus due to targeting Taiwan, attack times aligned with China work hours, and lack of Chinese targets. Liminal Panda is similarly linked with low confidence to China.
Remediation
Enea has detected and blocked several attempts by Liminal Panda to access operator networks, indicating active defense. Mobile operators should audit for hijacked nodes and secure signaling infrastructure to mitigate such interceptions.