SilentAir used hacked Asian telcos to intercept Taiwanese calls and texts
Original title: Hacked Asian Telcos Used to Intercept Taiwanese Calls and Texts
Enea says interception was 18.30% of SilentAir activity and some targets then received 2FA codes.
Enea said a state-level actor it calls SilentAir used hijacked mobile-operator equipment in at least six Asian countries to run SS7 and Diameter attacks, mainly against subscribers in Taiwan. Waves hit from a handful of users to several thousand a month, including silent SMS and some political and government VIPs. The November 11 research also describes Liminal Panda's GTPDoor backdoor, including a version that hides command-and-control in GTP-U user traffic. Enea said it helped customers remove Liminal Panda and warned operators hosting SilentAir sources.
Unconfirmed: Enea rates a China-nexus link and any tie between SilentAir and Liminal Panda as low confidence or unproven.
- Enea has tracked SilentAir since early 2025 and published on November 11.
- Attacks originated from equipment in at least six Asian countries and reached a dozen more.
- Interception was 18.30% of SilentAir activity, versus 2.07% for surveillance companies.
- Firewalls blocked several hundred GTPDoor command-and-control exchanges from early 2026.
- Enea believes at least five to 10 operators were infected, possibly several dozen.
Impact: Interception of calls, texts, and some 2FA codes
- Threat actors
- SilentAirLiminal Panda
- Malware
- GTPDoor
- Organizations
- EneaCrowdStrike
From the original article
2 min read at infosecurity-magazine.com
Enea linked SilentAir and Liminal Panda to attacks on Asian mobile operators
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.