State-level actor SilentAir uses hacked Asian telco networks to intercept Taiwanese subscribers' calls, texts and 2FA codes

Telecom security firm Enea disclosed on November 11 a new state-level actor it calls SilentAir, tracked since early 2025, which launches signalling attacks from compromised SS7/Diameter network elements in operators in at least six Asian countries, primarily targeting Taiwanese mobile subscribers and also hitting a dozen more countries and territories ^[1][2]. Enea says the attacks include location tracking, information harvesting and call and SMS interception, with some targets receiving 2FA codes right after interception began, indicating attempts to break into other accounts, plus large volumes of silent SMS sent to Taiwanese users; Enea assesses with low confidence that the activity aligns with China-nexus operations and sees a possible but unproven link to LIMINAL PANDA ^[1][2]. Enea recommends mobile operators deploy GTP-C and GTP-U security firewalls that share information with SS7 and Diameter firewalls, treat the IPX interconnect as untrusted, and build detection for signalling protocols inside their core networks ^[2].

Industries mainly affected: Government, Telecom