Enea found that interception made up 18.3% of the attacks it attributed to a newly identified group called SilentAir — nearly nine times the share seen in a typical surveillance company’s signaling attacks, the firm reported.
How SilentAir diverted calls and texts inside the IPX
Enea, a telecom and cybersecurity software company based in Stockholm, traced SilentAir to hacked equipment inside mobile operators across at least six Asian countries. The group injected malicious signaling into the shared inter-operator network known as the IPX, which carries SS7 and Diameter messages that route calls, texts and roaming traffic between operators.
To intercept traffic for selected targets, SilentAir sent UpdateLocation messages (or the Diameter equivalent) to a target’s home network, claiming that the compromised equipment was now serving the target’s phone. If the home network accepted the UpdateLocation, calls and texts were diverted to the attacker-controlled equipment. For some targets, Enea observed two-factor authentication (2FA) codes being intercepted immediately after the diversion took effect, indicating attempts to access other accounts tied to those phone numbers.
Scale, pattern and targets: Taiwan at the center
SilentAir’s activity came in bursts — sometimes from one or a few subscribers and at other times from several thousand over the course of a month — with gaps lasting months. The group targeted people mostly in Taiwan, and included political and government VIPs in some cases. Outside Taiwan, targets appeared in other Southeast and East Asian networks and, at times, in East Africa, Central Asia, the Middle East and Europe. The report does not name the specific countries, operators, or individual targets.
Enea also documented large-scale use of silent SMS — texts that do not display or alert on the phone. During daytime, most silent SMS were sent to subscribers on other networks (for example, Southeast Asian networks), and one of their main uses appears to have been testing whether a diversion was working: if a silent message reached the hacked equipment instead of the phone, the attacker knew the target’s texts were diverted. Most silent SMS went out at night and primarily to people in Taiwan; Enea said the purpose of those nighttime messages is not confirmed but may have been a bulk check that diversions remained in place.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTechnical indicators, tool overlaps, and attribution limits
Enea assessed with high confidence that SilentAir is a state-level actor, but linked the group’s activity to China only with low confidence. That low-confidence link rests on several signs: a strong focus on Taiwan with no targeting of Chinese networks or subscribers, and an operational tempo that tracked a UTC+8 workday — starting around 9 a.m., mostly stopping on weekends, and pausing or slowing around Chinese holidays.
The company considered a possible but unconfirmed connection between SilentAir and Liminal Panda, a group previously documented exploiting telecom signaling. In several hacked operators, SilentAir attacks coincided with a known Liminal Panda infection; at other times the two showed no sign of working together. Enea also noted behavioral overlap with SCTPE, a kernel-level Linux trojan designed to send and receive SS7 and Diameter traffic. Singapore’s Infocomm Media Development Authority has described the same tool under the name SIGweaver, and the advisory said CrowdStrike identified it on January 21 and links it to Liminal Panda with moderate confidence. But Enea reported key differences: SilentAir answered messages it had not sent itself — behavior SCTPE cannot reproduce — and SilentAir’s operational security appeared stronger than Liminal Panda’s.
Evidence of internal compromise and detection challenges
Enea’s investigators spotted that the networks hosting SilentAir handled follow-up signaling messages in odd, inconsistent ways. That left two possibilities: spoofed signaling addresses outside the networks, or compromised equipment inside them. The company then observed equipment inside a single operator both sending and receiving attack commands, which confirmed internal compromise. Detecting and blocking the attacks was difficult at first because the attacker understood mobile signaling and defenses; after containment, Enea recovered traces of unauthorized access but could not analyze the malware it believes SilentAir used.
What this means for mobile operators, policymakers, and end users
- Mobile operators: Enea told operators where it found SilentAir sources and said the activity has been disrupted for now but could return. It advised operators to treat the IPX as untrusted, add detection for signaling protocols inside their own networks, and connect signaling security with broader IT security.
- Policymakers and regulators: The cross-border nature of the compromises — hacked equipment inside operators in multiple countries — underlines the need for coordinated incident response and information sharing between national authorities and operator peers, especially where signaling links cross jurisdictions.
- End users and enterprises relying on SMS 2FA: Enea’s observation that 2FA codes were intercepted immediately after diversions underscores a concrete risk to SMS-based authentication for selected targets. The report does not say whether any accounts were successfully taken over.
Enea’s operational recommendations
Enea advised operators to deploy GTP-C and GTP-U firewalls and configure them to share information with SS7 and Diameter firewalls, move beyond basic industry signaling recommendations, add detection for signaling protocols inside their own networks, and integrate signaling controls with overall IT security. The company also reported detecting Liminal Panda activity at several customer operators this year and blocking that group’s GTPDoor traffic; it documented a new GTP-U variant that appears to act as a backup channel for hidden commands.
SilentAir’s access was found, contained for now, and traced across multiple networks — but the company warned the techniques can be reused and the actor could return. The record Enea published maps a sophisticated, telecom-aware intrusion that disrupted trust inside the IPX and exposed the fragility of SMS routing for high-value targets.
