SilentAir, a suspected China-nexus actor, hijacks Asian telecom nodes to intercept Taiwanese calls and SMS 2FA codes
Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 13/11/2026 12:03; os links antigos trazem para cá.
Fontes: securityweek.com ↗ thehackernews.com ↗ infosecurity-magazine.com ↗
Enea has identified SilentAir, a previously unknown state-level threat actor that intercepts calls and SMS messages, including SMS-based two-factor authentication (2FA) codes, by compromising mobile operator equipment. It primarily targets Taiwanese subscribers, among them political and government VIPs (thehackernews.com, securityweek.com). Enea has tracked the activity since early 2025. It affects operators in at least six Asian countries, and some operations extend to East Africa, Central Asia, the Middle East and Europe (securityweek.com). Attribution to China is made with low confidence only, based on the Taiwan focus, attack timing that matches China work hours, and the absence of Chinese targets (securityweek.com, thehackernews.com). The related but separate group Liminal Panda is deploying the GTPDoor backdoor in operator networks, and Enea says it has blocked several of its access attempts. The coverage was published on 12-13 November 2026.
Detalhes técnicos
- SS7 and Diameter abuse: SilentAir uses hijacked operator nodes to run signaling attacks, mainly over SS7 and occasionally Diameter. These reroute incoming calls and SMS through attacker-controlled nodes, expose subscriber details and track locations (securityweek.com). Within the trusted IPX network, it diverts traffic with fraudulent UpdateLocation messages (thehackernews.com).
- Silent SMS: The group sends large-scale silent SMS campaigns, mainly in Taiwan, presumably to verify that diversions are working (thehackernews.com, securityweek.com).
- Activity pattern and opsec: The attacks come in bursts separated by prolonged gaps, and the group shows advanced operational security (thehackernews.com).
- Aim of 2FA bypass: The campaign shows signs of an ambition to bypass 2FA for account takeovers (infosecurity-magazine.com).
- GTPDoor: GTPDoor is a Unix backdoor that tunnels command-and-control traffic through GPRS Tunneling Protocol (GTP). A new variant uses GTP-U, which is less monitored and prevalent in 5G environments (infosecurity-magazine.com). Liminal Panda uses it over the IPX network (securityweek.com).
Remediação
- Enhance signaling protocol defenses and treat IPX networks as untrusted (thehackernews.com).
- Audit for hijacked nodes and secure signaling infrastructure (securityweek.com).
- Enea has assisted affected operators and blocked several Liminal Panda access attempts, but warns that the risks persist (infosecurity-magazine.com, securityweek.com).
- Monitoring for GTP-U-based command-and-control is a reasonable addition, since that variant targets a less-monitored protocol. This is an inference from the sources, not an explicit recommendation.
Relatos divergentes
- Link to Liminal Panda: infosecurity-magazine.com says the groups are linked via similar infrastructure. thehackernews.com says SilentAir differs from Liminal Panda, with some activity overlaps. securityweek.com says the ties are inconclusive. The two groups should be treated as separate, with an unproven relationship.
- Account takeovers: infosecurity-magazine.com points to an ambition to bypass 2FA for account takeovers. thehackernews.com (the more specific source) says there is no confirming evidence of account takeovers and that no malware samples were uncovered.
- Liminal Panda timeline: securityweek.com says it has been active since early 2026. Enea's tracking of SilentAir dates to early 2025, and the other sources give no start date for Liminal Panda.
- Confidence: securityweek.com assesses with high confidence that SilentAir is a new state-level actor. Every source agrees the China link is low confidence.
Linha do tempo
-
SilentAir State-Level Actor Intercepts Calls and SMS via Compromised Mobile Networks
ler a análise desta fonte ocultar
Enea has identified a previously unknown state-level threat actor, SilentAir, actively intercepting phone calls and SMS messages by compromising mobile operator network nodes primarily targeting Taiwan. SilentAir conducts signaling attacks mainly through SS7 and occasionally Diameter protocols to reroute communications through hijacked nodes, exfiltrating subscriber details and tracking locations. Monitoring began in early 2025, revealing multiple Asian countries and other global regions under attack, with high-profile political and government figures as targets. A possibly related group, Liminal Panda, has been exploiting mobile operator interconnect networks with backdoors, though ties between the two groups remain inconclusive.
Technical Details
SilentAir utilizes hijacked mobile network nodes to conduct SS7 and Diameter signaling attacks that intercept incoming calls and SMS. The group also sends silent SMS messages to verify interception success. The attackers have targeted operators in at least six Asian countries, with some operations extending to East Africa, Central Asia, the Middle East, and Europe. Liminal Panda, active since early 2026, exploits the IPX network using the GTPDoor backdoor to communicate with command-and-control servers.
Attribution
SilentAir is assessed with high confidence as a new state-level actor, suspected with low confidence to have China nexus due to targeting Taiwan, attack times aligned with China work hours, and lack of Chinese targets. Liminal Panda is similarly linked with low confidence to China.
Remediation
Enea has detected and blocked several attempts by Liminal Panda to access operator networks, indicating active defense. Mobile operators should audit for hijacked nodes and secure signaling infrastructure to mitigate such interceptions.
-
SilentAir Group Exploits Compromised Telecom Equipment to Intercept SMS 2FA Codes Targeting Taiwanese Users
ler a análise desta fonte ocultar
The espionage group SilentAir has been observed infiltrating telecom operators across at least six Asian countries, primarily targeting Taiwanese users by intercepting their SMS-based two-factor authentication (2FA) codes and messages. By compromising internal telecom equipment, SilentAir manipulated SS7 and Diameter protocols within the trusted IPX network to divert calls and texts through fraudulent UpdateLocation messages. This allowed them to spy on political and government VIPs among other targets. The attacks, characterized by bursts and prolonged gaps, included large-scale silent SMS campaigns mainly in Taiwan, presumably to verify active diversions. Though Enea, the cybersecurity firm that identified SilentAir, links the group to a state-level actor with low confidence to China based on timing and targeting patterns, no confirming evidence of account takeovers or malware samples was uncovered. The group shows advanced operational security and differs from other known actors like Liminal Panda, though some activity overlaps were noted. Telecom operators were advised to enhance signaling protocol defenses and treat IPX networks as untrusted to mitigate such threats.
-
Threat Actor SilentAir Uses Compromised Asian Telcos to Intercept Taiwanese Communications
ler a análise desta fonte ocultar
The state-level threat actor SilentAir has been identified conducting sophisticated interception of calls and texts primarily targeting Taiwanese subscribers by exploiting compromised mobile operators in Asia. Enea has tracked the actor's SS7 and Diameter protocol-based attacks since early 2025, involving hijacked operator equipment across multiple countries. The campaign features waves of surveillance and silent SMS targeting, with indications of an ambition to bypass two-factor authentication for account takeovers. Concurrently, the Liminal Panda group, linked via similar infrastructure and attributed to China-nexus operations with low confidence, is deploying a Unix backdoor named GTPDoor that covertly tunnels command-and-control communications through GPRS Tunneling Protocol (GTP), including a new variant leveraging the less-monitored GTP-U protocol prevalent in 5G environments. Enea has assisted affected operators to mitigate these threats but warns of persistent risks.