SilentAir Group Exploits Compromised Telecom Equipment to Intercept SMS 2FA Codes Targeting Taiwanese Users
The espionage group SilentAir has been observed infiltrating telecom operators across at least six Asian countries, primarily targeting Taiwanese users by intercepting their SMS-based two-factor authentication (2FA) codes and messages. By compromising internal telecom equipment, SilentAir manipulated SS7 and Diameter protocols within the trusted IPX network to divert calls and texts through fraudulent UpdateLocation messages. This allowed them to spy on political and government VIPs among other targets. The attacks, characterized by bursts and prolonged gaps, included large-scale silent SMS campaigns mainly in Taiwan, presumably to verify active diversions. Though Enea, the cybersecurity firm that identified SilentAir, links the group to a state-level actor with low confidence to China based on timing and targeting patterns, no confirming evidence of account takeovers or malware samples was uncovered. The group shows advanced operational security and differs from other known actors like Liminal Panda, though some activity overlaps were noted. Telecom operators were advised to enhance signaling protocol defenses and treat IPX networks as untrusted to mitigate such threats.
Linha do tempo
-
SilentAir Group Exploits Compromised Telecom Equipment to Intercept SMS 2FA Codes Targeting Taiwanese Users
ler a análise desta fonte ocultar
The espionage group SilentAir has been observed infiltrating telecom operators across at least six Asian countries, primarily targeting Taiwanese users by intercepting their SMS-based two-factor authentication (2FA) codes and messages. By compromising internal telecom equipment, SilentAir manipulated SS7 and Diameter protocols within the trusted IPX network to divert calls and texts through fraudulent UpdateLocation messages. This allowed them to spy on political and government VIPs among other targets. The attacks, characterized by bursts and prolonged gaps, included large-scale silent SMS campaigns mainly in Taiwan, presumably to verify active diversions. Though Enea, the cybersecurity firm that identified SilentAir, links the group to a state-level actor with low confidence to China based on timing and targeting patterns, no confirming evidence of account takeovers or malware samples was uncovered. The group shows advanced operational security and differs from other known actors like Liminal Panda, though some activity overlaps were noted. Telecom operators were advised to enhance signaling protocol defenses and treat IPX networks as untrusted to mitigate such threats.