“Interception accounted for 18.30% of SilentAir’s activity,” Enea reported, a share far above the 2.07% typical for the surveillance companies behind most signaling attacks.
SilentAir: a newly identified state-level actor targeting Taiwanese subscribers
Enea, which provides software for telecommunications and cybersecurity, named a previously unreported actor “SilentAir” in research published on November 11. Enea said it has watched SilentAir since early 2025 and is “highly confident” the actor operates at the state level. The activity focused primarily on subscribers in Taiwan and included political and government VIPs among its targets.
According to Enea, SilentAir used hijacked equipment inside mobile operators across at least six Asian countries to launch signaling attacks that reached targets in a dozen more countries and territories. The intrusions occurred in waves — from a handful of subscribers to several thousand in a month — separated by quiet periods that lasted months.
Techniques: SS7, Diameter, silent SMS and 2FA interception
Enea reported SilentAir launched attacks over Signaling System No. 7 (SS7) and Diameter. Interception accounted for 18.30% of SilentAir’s activity; by comparison Enea said interception makes up only about 2.07% of activity for the surveillance companies that typically exploit signaling systems.
In multiple cases, two-factor authentication (2FA) codes arrived “moments after interception began,” which Enea said indicated an objective of breaking into other accounts. Much of SilentAir’s other activity consisted of silent SMS — texts that never appear on the recipient’s phone — sent largely to Taiwanese users around midnight.
Enea linked the group to China-nexus operations with low confidence, citing the Taiwan focus, the absence of Chinese targets, working hours that match China’s time zone and lulls during Chinese holidays.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleLiminal Panda and GTPDoor: a separate but related operator evolution
Enea’s November 11 research also covers Liminal Panda, a group previously observed attacking mobile operators. Enea said its firewalls spotted and blocked GTPDoor and other Liminal Panda activity at several customer operators from early 2026, detecting several hundred attempted command-and-control (C2) exchanges.
GTPDoor is a Unix backdoor that hides C2 traffic inside the GPRS Tunneling Protocol (GTP), which carries roaming and user data. Enea said it had seen at least five to 10 operators infected by Liminal Panda, either directly or through strong indications, and believes the true figure might be several dozen concentrated in Asia, Africa and Latin America.
Notably, Enea observed a new GTPDoor variant that rode on GTP‑U, the protocol’s user-data plane. Enea said GTP‑U traffic is far heavier and “less closely watched,” and, unlike the control-plane side, it carries over into 5G. Enea believed the new version mostly served as a fallback.
CrowdStrike had earlier linked Liminal Panda to China-nexus operations in November 2024, also with low confidence — a point Enea referenced in its analysis.
What this means for technologists, policymakers, and Taiwanese subscribers
- Technologists and security teams: Enea’s findings put a spotlight on monitoring for hijacked operator equipment, SS7/Diameter signaling abuse, silent SMS patterns and anomalous GTP‑U traffic that could carry embedded C2. Enea’s firewalls detected several hundred attempted C2 exchanges, signaling that perimeter and in‑network detection logic needs to account for tunneling inside roaming and user-data protocols.
- Policymakers and regulators: The attacks used compromised infrastructure across at least six Asian countries and affected targets in a dozen more countries and territories, creating a cross-border dimension that regulators and telecom supervisors will need to consider when setting requirements for inter-operator security and incident notification.
- Taiwanese subscribers and customers of affected operators: Enea’s observation that interception sometimes coincided with near-immediate arrival of 2FA codes — and that silent SMS were sent around midnight to Taiwanese users — underscores an operational risk to account security and privacy for subscribers targeted in these campaigns.
Enea’s response and the near-term outlook
Enea said it helped customers clear Liminal Panda from affected systems and alerted operators that hosted SilentAir sources. The firm reported that both groups have been “set back for now,” but warned that the conditions that allowed these operations to succeed remain in place and could permit a return, by these actors or others.
The technical details Enea shared — SS7 and Diameter signaling attacks from hijacked operator equipment, silent SMS targeting and a GTPDoor variant that moved to GTP‑U — map a concrete escalation of tactics against mobile infrastructure. For the moment, Enea’s detection and remediation actions have disrupted activity; the company’s own assessment is a reminder that disruption is not elimination.
