SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users Swati KhandelwalNov 13, 2026Cyber Espionage / Threat Intelligence A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan. Enea, a telecom and cybersecurity software company based in Stockholm, found the group's attack sources in at least six Asian countries and named it SilentAir this week. It assessed with high confidence that SilentAir is a state-level actor, but linked its activity to China only with low confidence. The company has told the operators where it found SilentAir sources. It said SilentAir has been disrupted for now but could return. The report does not say whether those operators have cleaned up the hacked equipment. Mobile operators use the SS7 and Diameter protocols to exchange signaling messages that route calls and texts and enable roaming. This traffic crosses a shared network called the IPX, which runs on a high level of trust between operators. SilentAir sent its attacks into the IPX from the hacked equipment. For interception, SilentAir sent the target's home network an UpdateLocation message, or its Diameter equivalent. The message claimed that the hacked equipment was now serving the target's phone. If the home network accepted it, calls and texts for that person would be diverted to the attackers. Some of these attacks worked. For some targets, the company observed two-factor authentication (2FA) codes being intercepted immediately after the diversion took effect. That points to an attempt to break into other accounts registered to those people. The report gives no similar evidence for voice calls, and it does not say whether any account was taken over. Interception made up 18.3% of the attacks the company saw from SilentAir. For a typical surveillance company, the kind of firm behind most signaling attacks, the share was 2.1% in the company's earlier research. Some targets were political and government VIPs in their own countries. In rare cases, SilentAir equipment in several countries worked together against such targets, which the company said points to a single controller. The attacks came in bursts, from one or a few subscribers to several thousand over a month, with gaps of up to several months or longer between bursts. Outside Taiwan, targets were mostly in other Southeast and East Asian networks, and at times in East Africa, Central Asia, the Middle East, and Europe. People using the hacked operators' own networks may also have been targeted, but the company could not see that traffic. The company spotted SilentAir by studying attacks on the links between operators. Since early 2025, it has tracked unusual attacks, mostly over SS7 and sometimes Diameter, from some Asian operators that would not normally send attacks. Later analysis found suspicious activity even earlier. The networks hosting SilentAir handled follow-up messages for diverted targets in odd and inconsistent ways, according to the company's technical report. That left two explanations: someone outside was faking those networks' signaling addresses, or equipment inside each network had been taken over. The company then saw equipment inside one operator both send and receive attack commands, which confirmed the second explanation. That equipment behaved exactly like SilentAir sources in other networks. Detecting and blocking the attacks was hard at first because the attackers understood mobile networks and signaling defenses well. After the attacks were contained, the company recovered traces of unauthorized access. It could not analyze the malware it believes SilentAir used. The report does not name the countries, the operators, or any of the targets. In some countries, SilentAir attacks came from more than one operator. SilentAir also sent silent SMS on a very large scale, mainly to subscribers in Taiwan. These are texts that the phone does not display or alert on. During the day, most silent SMS went to subscribers on other networks, such as Southeast Asian networks. One of their main uses appears to have been checking whether a diversion had worked, the company said. If the test text reached the hacked equipment instead of the phone, the attackers knew they were getting that person's texts. Most silent SMS went out at night, and most of those went to people in Taiwan. The company said the purpose of those messages is not confirmed. They may be a bulk check that earlier diversions were still in place, since phones are least likely to re-register to their real location at night. The silent texts carried spam-like motivational or promotional lines, often in English. The company believes the text was a disguise. If an operator along the way stripped a message's silent setting, the recipient would see it as spam and ignore it. The company's low-confidence link to China rests on several signs. SilentAir focused on Taiwan and did not target Chinese networks or subscribers. Its tracking and interception attacks also followed a working day in UTC+8, which is China Standard Time. They started at 9 a.m., almost stopped on weekends, and paused or slowed around Chinese holidays. The company also considered a link to Liminal Panda, a group behind earlier telecom intrusions. It called the link possible but unconfirmed and does not tie the two groups together for now. In several hacked operators, SilentAir attacks happened during a known Liminal Panda infection. At other times, the two showed no sign of working together. They also went after operators in the same part of Asia, though Liminal Panda has no known focus on Taiwan. SilentAir's behavior also partly matches that of SCTPE, a little-known Linux trojan that runs in the kernel and is designed to send and receive SS7 and Diameter traffic. Singapore's Infocomm Media Development Authority (IMDA) has described the same tool in a government advisory. There, the tool is called SIGweaver. The agency said CrowdStrike identified it on January 21 and links it to Liminal Panda with moderate confidence. But Enea said SilentAir answered messages it had not sent itself, which the known SCTPE program cannot do. SilentAir's operational security also seemed far better than Liminal Panda's. Separately, the company's GTP firewall has detected Liminal Panda activity at several customer operators since the first quarter of this year. The company blocked the group's GTPDoor traffic there and saw Liminal Panda infections, or strong signs of them, in at least 5 to 10 operators. The GTPDoor backdoor, first documented on February 27, 2024, hides commands within GTP-C, the protocol that establishes mobile data connections between networks. The company also found evidence of a new version that hides commands in GTP-U, the part of GTP that carries users' data. GTP-U traffic is harder to inspect, though the company believes the new version serves mainly as a backup. The company said any attacker could reuse these techniques, and it told operators to: Deploy GTP-C and GTP-U firewalls and configure them to share information with their SS7 and Diameter firewalls. Go beyond the industry's basic recommendations for signaling security. Add detection for signaling protocols inside their own networks. Connect signaling security with the rest of their IT security. The report does not advise people whose calls and texts may be targeted. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cyber espionage, Malware, mobile security, network security, Telecom Security, Threat Intelligence Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run The Flood is Coming And The Pipes Were Already Full ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk