SilentAir Hijacks Signaling Gear in Asian Mobile Operators to Steal SMS 2FA Codes from Taiwanese Targets

A state-level espionage group has been using hacked equipment inside mobile operators in at least six Asian countries to divert the calls and texts of selected subscribers, mostly in Taiwan. Enea, the Stockholm-based telecom security company that named the group SilentAir this week, saw two-factor authentication codes being intercepted right after some diversions took effect. Interception made up 18.3% of the SilentAir attacks Enea observed. In Enea's earlier research, the share for a typical commercial surveillance firm was 2.1%, so SilentAir's rate is almost nine times higher.

Enea assesses with high confidence that SilentAir is a state-level actor. It links the group to China only with low confidence. Enea has told the affected operators where it found SilentAir sources and says the group is disrupted for now but could return. The report does not name any countries, operators or targets, and it does not say whether the hacked equipment has been cleaned up.

How the Interception Works

Mobile operators exchange signaling messages over SS7 and Diameter. These messages route calls and texts and make roaming possible. The traffic crosses the IPX, a shared interconnect network that runs on a high level of trust between operators. SilentAir did not spoof its way into that network. It sent its attacks from equipment inside real operators that it had already compromised.

To intercept a target, SilentAir sent the target's home network an UpdateLocation message, or the Diameter equivalent, claiming that the hacked equipment was now serving the target's phone. When the home network accepted the message, calls and texts for that subscriber were sent to the attackers. Some of these attacks worked. For some targets, Enea saw 2FA codes intercepted right after the diversion took effect, which points to attempts to break into other accounts registered to those people. The report has no similar evidence for voice calls and does not say whether any account was actually taken over.

Targets and Tempo

Some targets were political and government VIPs in their own countries. In rare cases, SilentAir equipment in several countries worked together against a single target, which Enea says points to one controller. Activity came in bursts. A burst could cover anything from one or a few subscribers to several thousand over a month, and bursts were separated by gaps of up to several months or longer. Outside Taiwan, most targets were on other Southeast and East Asian networks, with some in East Africa, Central Asia, the Middle East and Europe. Subscribers on the hacked operators' own networks may also have been targeted, but Enea could not see that traffic.

Silent SMS as a Diversion Check

SilentAir also sent silent SMS at very large scale, mostly to subscribers in Taiwan. A silent SMS is a text the phone does not display or alert on. During the day, most of these went to subscribers on other networks, such as Southeast Asian ones. Enea says one of their main uses appears to have been checking whether a diversion had worked: if the test text arrived at the hacked equipment instead of the phone, the attackers knew they were receiving that person's messages.

Most silent SMS went out at night, and most of the night traffic went to people in Taiwan. Enea has not confirmed what those messages were for. One possibility is a bulk check that earlier diversions were still in place, since phones are least likely to re-register to their real location at night. The texts contained spam-like motivational or promotional lines, often in English. Enea believes this was a disguise: if an operator along the route stripped the silent setting, the recipient would see what looked like spam and ignore it.

Inside the Operators, Not Spoofing Them

Enea found SilentAir by studying attacks on the links between operators. Since early 2025, it had been tracking unusual attacks, mostly over SS7 and sometimes over Diameter, from Asian operators that would not normally send attacks. Later analysis found suspicious activity going back even earlier. The host networks handled follow-up messages for diverted targets in odd and inconsistent ways. That left two explanations: someone outside was faking those networks' signaling addresses, or equipment inside each network had been taken over. Enea then saw equipment inside one operator both send and receive attack commands, which confirmed the second explanation. That equipment behaved exactly like SilentAir sources in other networks.

In some countries, SilentAir attacks came from more than one operator. Detection and blocking were hard at first because the attackers understood mobile networks and signaling defenses well. After containment, Enea recovered traces of unauthorized access, but it could not analyze the malware it believes SilentAir used.

Attribution: China, Liminal Panda and SCTPE

Enea's low-confidence link to China rests on several signs. SilentAir focused on Taiwan and did not target Chinese networks or subscribers. Its tracking and interception followed a working day in UTC+8, which is China Standard Time: activity started at 9 a.m., almost stopped on weekends, and paused or slowed around Chinese holidays.

Enea calls a link to Liminal Panda, a group behind earlier telecom intrusions, possible but unconfirmed. In several hacked operators, SilentAir attacks took place during a known Liminal Panda infection, and both groups went after operators in the same part of Asia. At other times, however, the two showed no sign of working together, and Liminal Panda has no known focus on Taiwan.

SilentAir's behavior also partly matches SCTPE, a little-known Linux kernel trojan built to send and receive SS7 and Diameter traffic. A Singapore IMDA advisory describes the same tool under the name SIGweaver. According to that advisory, CrowdStrike identified it on January 21 and links it to Liminal Panda with moderate confidence. Enea points to one difference: SilentAir answered messages it had not sent itself, and the known SCTPE program cannot do that.

RedEye Assessment

SilentAir shows the weak point in signaling defenses that check where a message comes from. When the sender is legitimate operator equipment that has been compromised, its traffic carries the trust the IPX gives to that operator. The 18.3% interception share points to collection of specific people's communications rather than broad location tracking. The SMS 2FA captures show the goal reached past phones to the accounts tied to those numbers. Enea's notifications to operators and the disruption it reports are the only mitigation it describes, and Enea expects SilentAir could come back.

• Attack surface: signaling equipment inside operators in 6+ Asian countries, sometimes more than one operator per country.
• Technique: forged SS7 UpdateLocation and Diameter equivalents sent over the IPX to divert calls and texts.
• Validation: large-scale silent SMS disguised as spam, sent mostly to Taiwan and mostly at night.
• Attribution: state-level with high confidence; China with low confidence; possible overlap with Liminal Panda and partial overlap with SCTPE (SIGweaver).