A cyber espionage group known as SilentAir has been attacking telecoms infrastructure throughout Asia to listen in on selected individuals’ calls and text messages. This was uncovered by Enea, a telecom security firm based in Stockholm. They believe with high confidence that the campaign is state-sponsored, however it is uncertain how connected it is to China.
Enea were able to trace the attacks to compromised devices within mobile operators in at least 6 countries throughout Asia.
They have informed the operators but cannot confirm that all devices are now clean.
SilentAir attacked the trust between mobile networks using the SS7 and Diameter protocols to communicate. This communication occurs on the IPX network which links all operators together. They sent false UpdateLocation messages to the compromised devices claiming they were the serving network for targeted users. When this was accepted calls and texts were redirected towards the attacker.
Whilst they were intercepting some calls, Enea were able to see SMS 2FA codes being captured straight after the redirection. This suggests they were trying to breach other accounts for their victims.
However during their investigation there was no confirmation that they were able to take over any accounts, nor was there any evidence of voice calls being intercepted.
Intercepting calls made up 18.3% of the attacks they observed compared to only 2.1% from their previous research into common signalling attacks. There were many high value targets such as political and government individuals.
In some cases multiple compromised devices were used across different countries to target the same individuals suggesting there was some central control.
The attacks occurred in short bursts. At times thousands of subscribers were targeted but then nothing happened for months. Whilst the main focus was Taiwan, networks across Southeast Asia, East Asia, East Africa, Central Asia, Middle East and Europe were also targeted.
There was a large amount of silent SMS being used. Many targeted Taiwanese subscribers during the evening, potentially to check if the redirection was working. Many were sent during the day to subscribers on other networks. The messages had generic English text relating to promotions and motivation, so could have been seen as spam if the silent settings were turned off by the operators.
Enea started to see strange signalling activity in early 2025.
Eventually they were able to see compromised devices sending and receiving attack commands confirming that the operators internal infrastructure had been compromised.
They looked into potential links with another telecom focussed threat group called Liminal Panda but there wasn’t enough evidence to connect them. SilentAir also had similarities to SCTPE, a Linux based tool used to manage SS7 and Diameter traffic. This has been referred to as SIGweaver within a government advisory from Singapore.
However the capabilities differ and there was not enough operational security to link them.
Liminal Panda activity was also detected by Enea across multiple customer networks in early 2026. They blocked GTPDoor backdoor traffic across at least 5-10 operators. The new version of this is harder to detect as it hides the commands within GTP-U traffic.
Enea recommend using GTP-C and GTP-U firewalls, treating all IPX connections as untrusted and ensuring telecom monitoring is brought into the wider IT security.
Read the original article:
SilentAir Hacks Asian Telecom Networks to Intercept Calls and SMS Verification Codes