Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

SilentAir hijacks Asian telecom gear to intercept Taiwanese calls and texts

3 sources · 3 articlesFirst reported Updated ()
What's new

November 13: SecurityWeek adds that silent SMS may test whether interception worked, location tracking was a smaller share, and Liminal Panda is described as the only actor known to actively exploit IPX.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Enea says SilentAir diverted Taiwanese calls and texts, including some 2FA codes, from hijacked operator nodes in at least six Asian countries.

Enea says a previously unknown, state-level actor it calls SilentAir used hijacked mobile-operator equipment in at least six Asian countries to send SS7 and sometimes Diameter signaling into the IPX, mainly against subscribers in Taiwan. UpdateLocation-style messages diverted selected calls and texts, and some two-factor codes were intercepted afterward; a dozen other countries and territories, including political and government figures, were also hit. Interception was 18.3% of observed SilentAir activity, versus 2.07% for surveillance companies, while location tracking was a smaller share. Enea rates a China link only with low confidence and says the activity is disrupted for now but could return. The same research describes Liminal Panda’s GTPDoor; any link to SilentAir is possible but not strongly evidenced.

Key facts
  • Enea has tracked SilentAir since early 2025 and published research on November 11.
  • Interception was 18.3% of SilentAir activity, versus 2.07% for surveillance companies.
  • Firewalls blocked several hundred GTPDoor command-and-control exchanges from early 2026.
  • Enea believes at least five to 10 operators were infected, possibly several dozen.
  • Activity followed a UTC+8 workday and paused around Chinese holidays.
  • Operators were notified; countries and operators remain unnamed.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 11, 2026Enea publishes SilentAir and GTPDoor research. · Infosecurity Magazine

What each outlet adds

beyond the shared facts
  • Infosecurity Magazine18.30% versus 2.07%; GTP-U C2 hiding; operator infection range.
  • The Hacker NewsUTC+8 hours, holiday pauses, disrupted for now, low-confidence China link.
  • SecurityWeekSilent SMS may verify interception; location tracking a smaller share.
Vendors
Enea
Threat actors
SilentAirLiminal Panda
Malware
SCTPESIGweaverGTPDoor
Organizations
EneaInfocomm Media Development AuthorityCrowdStrike
Countries
TaiwanChina

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Infosecurity MagazineFirst report

    SilentAir used hacked Asian telcos to intercept Taiwanese calls and texts

    Enea says interception was 18.30% of SilentAir activity and some targets then received 2FA codes.

  2. · 1d ago The Hacker News

    SilentAir hijacked Asian telecom gear to intercept SMS 2FA codes

    Enea says diversion attacks from at least six Asian countries intercepted some 2FA texts, mainly targeting people in Taiwan.

  3. · 1d ago SecurityWeek

    SilentAir intercepts calls and SMS via hijacked mobile networks

    Enea says the group mainly targets Taiwan from operator nodes in at least six Asian countries, using SS7 and Diameter.