Ethical Hacking News
A recently identified group of hackers, dubbed SilentAir, has been found to be hijacking Asian telecom networks to intercept SMS 2FA codes and spy on Taiwanese users. According to a recent report by Enea, a state-level actor is behind the attacks, which have been linked to China with low confidence. The attacks have been found to be sophisticated, using techniques such as UpdateLocation messages to divert calls and texts to the attackers. The company has recommended several steps for telecom operators and mobile network users to improve their security and protect against such attacks.
SilentAir, a state-level actor, has been identified as a group of hackers hijacking Asian telecom networks to intercept SMS 2FA codes and spy on Taiwanese users. SilentAir has used a sophisticated technique to intercept SMS 2FA codes, including sending an UpdateLocation message to the target's home network. The group has been able to intercept 2FA codes in 18.3% of attacks, which is significantly higher than the typical share of such attacks. SilentAir has targeted political and government VIPs in their own countries, suggesting a single controller coordinating the group's efforts. The attacks came in bursts, from one or a few subscribers to several thousand over a month, with gaps of up to several months or longer between bursts. The company linked SilentAir to China only with low confidence, suggesting that the true extent of the group's involvement with the Chinese government remains unclear. Enea has recommended several steps for telecom operators and mobile network users to improve their security, including deploying GTP firewalls and treating the IPX as untrusted.
In a significant development that has left experts and cybersecurity enthusiasts abuzz, a newly identified group of hackers, dubbed SilentAir, has been found to be hijacking Asian telecom networks to intercept SMS 2FA codes and spy on Taiwanese users. According to a recent report by Enea, a telecom and cybersecurity software company based in Stockholm, SilentAir has been using hacked equipment inside Asian mobile operators to intercept the calls and texts of selected individuals, mostly in Taiwan.
The report, which was published on November 13, 2026, reveals that SilentAir is a state-level actor, with high confidence that it is a state-sponsored group. However, the company notes that it linked SilentAir's activity to China only with low confidence, suggesting that the true extent of the group's involvement with the Chinese government remains unclear.
The report highlights that SilentAir used a sophisticated technique to intercept SMS 2FA codes, which are used to verify the identity of users on their mobile devices. By sending an UpdateLocation message to the target's home network, SilentAir claimed that the hacked equipment was now serving the target's phone. If the home network accepted it, calls and texts for that person would be diverted to the attackers, allowing them to intercept the 2FA codes.
The company observed that some of these attacks worked, and for some targets, the attackers were able to intercept the 2FA codes immediately after the diversion took effect. This suggests that SilentAir was able to break into other accounts registered to those people, providing the attackers with access to sensitive information.
However, the report notes that there is no evidence to suggest that SilentAir was able to intercept voice calls, and it does not seem to have taken over any accounts. The company also observed that interception made up 18.3% of the attacks it saw from SilentAir, which is significantly higher than the typical share of such attacks.
The report highlights that some targets were political and government VIPs in their own countries, and that in rare cases, SilentAir equipment in several countries worked together against such targets. This suggests that SilentAir may have a single controller, which is coordinating the group's efforts.
The attacks came in bursts, from one or a few subscribers to several thousand over a month, with gaps of up to several months or longer between bursts. Outside Taiwan, targets were mostly in other Southeast and East Asian networks, and at times in East Africa, Central Asia, the Middle East, and Europe. People using the hacked operators' own networks may also have been targeted, but the company could not see that traffic.
The company spotted SilentAir by studying attacks on the links between operators. Since early 2025, it has tracked unusual attacks, mostly over SS7 and sometimes Diameter, from some Asian operators that would not normally send attacks. Later analysis found suspicious activity even earlier.
The networks hosting SilentAir handled follow-up messages for diverted targets in odd and inconsistent ways, according to the company's technical report. This left two explanations: someone outside was faking those networks' signaling addresses, or equipment inside each network had been taken over.
The company then saw equipment inside one operator both send and receive attack commands, which confirmed the second explanation. That equipment behaved exactly like SilentAir sources in other networks.
Detecting and blocking the attacks was hard at first because the attackers understood mobile networks and signaling defenses well. After the attacks were contained, the company recovered traces of unauthorized access. It could not analyze the malware it believes SilentAir used.
The report does not name the countries, the operators, or any of the targets. In some countries, SilentAir attacks came from more than one operator.
SilentAir also sent silent SMS on a very large scale, mainly to subscribers in Taiwan. These are texts that the phone does not display or alert on. During the day, most silent SMS went to subscribers on other networks, such as Southeast Asian networks. One of their main uses appears to have been checking whether a diversion had worked, the company said.
If the test text reached the hacked equipment instead of the phone, the attackers knew they were getting that person's texts. Most silent SMS went out at night, and most of those went to people in Taiwan. The company said the purpose of those messages is not confirmed. They may be a bulk check that earlier diversions were still in place, since phones are least likely to re-register to their real location at night.
The silent texts carried spam-like motivational or promotional lines, often in English. The company believes the text was a disguise. If an operator along the way stripped a message's silent setting, the recipient would see it as spam and ignore it.
The company's low-confidence link to China rests on several signs. SilentAir focused on Taiwan and did not target Chinese networks or subscribers. Its tracking and interception attacks also followed a working day in UTC+8, which is China Standard Time. They started at 9 a.m., almost stopped on weekends, and paused or slowed around Chinese holidays.
The company also considered a link to Liminal Panda, a group behind earlier telecom intrusions. It called the link possible but unconfirmed and does not tie the two groups together for now.
In several hacked operators, SilentAir attacks happened during a known Liminal Panda infection. At other times, the two showed no sign of working together. They also went after operators in the same part of Asia, though Liminal Panda has no known focus on Taiwan.
SilentAir's behavior also partly matches that of SCTPE, a little-known Linux trojan that runs in the kernel and is designed to send and receive SS7 and Diameter traffic. Singapore's Infocomm Media Development Authority (IMDA) has described the same tool in a government advisory. There, the tool is called SIGweaver. The agency said CrowdStrike identified it on January 21 and links it to Liminal Panda with moderate confidence.
But Enea said SilentAir answered messages it had not sent itself, which the known SCTPE program cannot do. SilentAir's operational security also seemed far better than Liminal Panda's.
The company's GTP firewall has detected Liminal Panda activity at several customer operators since the first quarter of this year. The company blocked the group's GTPDoor traffic there and saw Liminal Panda infections, or strong signs of them, in at least 5 to 10 operators.
The report does not recommend any specific actions for individuals whose calls and texts may be targeted, as it notes that the attacks are a significant concern for telecom operators and mobile network users.
In light of the recent report, Enea has recommended several steps for telecom operators and mobile network users to improve their security:
Deploy GTP-C and GTP-U firewalls and configure them to share information with their SS7 and Diameter firewalls.
Go beyond the industry's basic recommendations for signaling security.
Treat the whole IPX as untrusted.
Add detection for signaling protocols inside their own networks.
Connect signaling security with the rest of their IT security.
The report highlights the need for improved security measures to protect against such attacks, and for telecom operators and mobile network users to take proactive steps to strengthen their defenses.
Related Information:
https://www.ethicalhackingnews.com/articles/SilentAir-A-State-Level-Actor-in-Cyber-Espionage-Hijacking-Asian-Telecom-Networks-to-Intercept-SMS-2FA-Codes-and-Spy-on-Taiwanese-Users-ehn.shtml
https://thehackernews.com/2026/11/silentair-hijacks-asian-telecom.html
Published: Fri Nov 13 07:12:50 2026 by llama3.2 3B Q4_K_M
