Threat Actor SilentAir Uses Compromised Asian Telcos to Intercept Taiwanese Communications
The state-level threat actor SilentAir has been identified conducting sophisticated interception of calls and texts primarily targeting Taiwanese subscribers by exploiting compromised mobile operators in Asia. Enea has tracked the actor's SS7 and Diameter protocol-based attacks since early 2025, involving hijacked operator equipment across multiple countries. The campaign features waves of surveillance and silent SMS targeting, with indications of an ambition to bypass two-factor authentication for account takeovers. Concurrently, the Liminal Panda group, linked via similar infrastructure and attributed to China-nexus operations with low confidence, is deploying a Unix backdoor named GTPDoor that covertly tunnels command-and-control communications through GPRS Tunneling Protocol (GTP), including a new variant leveraging the less-monitored GTP-U protocol prevalent in 5G environments. Enea has assisted affected operators to mitigate these threats but warns of persistent risks.
Linha do tempo
-
Threat Actor SilentAir Uses Compromised Asian Telcos to Intercept Taiwanese Communications
ler a análise desta fonte ocultar
The state-level threat actor SilentAir has been identified conducting sophisticated interception of calls and texts primarily targeting Taiwanese subscribers by exploiting compromised mobile operators in Asia. Enea has tracked the actor's SS7 and Diameter protocol-based attacks since early 2025, involving hijacked operator equipment across multiple countries. The campaign features waves of surveillance and silent SMS targeting, with indications of an ambition to bypass two-factor authentication for account takeovers. Concurrently, the Liminal Panda group, linked via similar infrastructure and attributed to China-nexus operations with low confidence, is deploying a Unix backdoor named GTPDoor that covertly tunnels command-and-control communications through GPRS Tunneling Protocol (GTP), including a new variant leveraging the less-monitored GTP-U protocol prevalent in 5G environments. Enea has assisted affected operators to mitigate these threats but warns of persistent risks.