Overview
Swedish telecom security firm Enea has identified a spying group it calls SilentAir, which used hacked equipment inside Asian mobile operators to intercept calls and texts of selected people, mostly in Taiwan. Enea found attack sources in at least six Asian countries. It has told the affected operators where the sources were found. Enea says SilentAir was disrupted but could return.
How the Interception Works
SilentAir abused the SS7 and Diameter signaling protocols, which carry call and text routing and roaming data across the IPX, a network operators largely trust.
- The hacked operator equipment sent an
UpdateLocationmessage (or its Diameter equivalent) to the target's home network, falsely claiming it was serving the target's phone. - If accepted, the target's calls and texts were diverted to the attackers.
- For some targets, Enea saw 2FA codes intercepted right after diversion, which could be used to take over other accounts. Enea found no evidence of actual account takeover.
The group also sent silent SMS at scale, mainly to Taiwanese subscribers. Daytime messages to other networks appear to have tested whether a diversion worked. Night-time messages had an unconfirmed purpose, possibly bulk checks that diversions were still active. The text was spam-like promotional content, likely a disguise.
Targets and Pattern
- Mobile subscribers in Taiwan were the primary focus.
- Political and government VIPs in their own countries were also targeted, as were networks in other Southeast and East Asian countries and, at times, East Africa, Central Asia, the Middle East and Europe.
- Attacks came in bursts lasting up to a month, from one or a few subscribers up to several thousand, separated by gaps of months or more.
- Enea could not see traffic from the hacked operators' own subscribers, so those users may also have been affected.
- In rare cases, equipment in several countries worked together against the same targets, suggesting a single controller.
Attribution
Enea assessed with high confidence that SilentAir is a state-level actor and linked it to China with low confidence, citing the Taiwan focus with no Chinese targets, and activity that follows a UTC+8 working day and slows on weekends and Chinese holidays.
Enea did not recover the malware, only traces of unauthorized access. Behavior partly resembles SCTPE, a Linux kernel trojan for SS7 and Diameter traffic (Singapore's IMDA calls it SIGweaver and links it to Liminal Panda with moderate confidence). Enea says the two are not the same, because SCTPE cannot answer messages it did not send and SilentAir did. A link to Liminal Panda is possible but unconfirmed.
Separately, Enea reported Liminal Panda activity at several operators since Q1, including infections or strong signs of GTPDoor (commands hidden in GTP-C) in at least 5 to 10 operators, plus a newer variant hiding commands in GTP-U.
Recommendations
Enea's advice is aimed at operators:
- Deploy GTP-C and GTP-U firewalls and share information with SS7 and Diameter firewalls.
- Go beyond basic industry signaling-security recommendations.
- Treat the entire IPX as untrusted.
- Detect signaling-protocol activity inside their own networks.
- Integrate signaling security with broader IT security.
The report gives no guidance for individuals. As a general precaution, prefer app-based or hardware-key 2FA over SMS codes for high-value accounts. Enea's article lists no public IOCs; they are in its technical report.