SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users
A newly identified spying group, SilentAir, has hacked Asian telecom equipment to intercept SMS 2FA codes and spy on users, mostly in Taiwan.
The Stockholm-based telecom and cybersecurity company Enea discovered the group's attack sources in at least six Asian countries and named it SilentAir this week. The company assessed with high confidence that SilentAir is a state-level actor, though it linked its activity to China only with low confidence.
SilentAir exploited the SS7 and Diameter protocols used by mobile operators to exchange signaling messages that route calls and texts. The attacks were sent into the shared IPX network from the compromised equipment within these operators.
Interception Method
For interception, SilentAir sent the target's home network an UpdateLocation message, claiming the hacked equipment was now serving the target's phone. If accepted, calls and texts for that person would be diverted to the attackers.
Attack Patterns
Interception made up 18.3% of SilentAir's attacks, significantly higher than the 2.1% typical for surveillance companies. Some targets were political and government VIPs, with rare cases showing coordinated attacks across multiple countries against single targets.
The attacks came in bursts, from one or a few subscribers to several thousand over a month, with gaps of up to several months between bursts. Targets were primarily in Taiwan and other Southeast and East Asian networks, with occasional activity in East Africa, Central Asia, the Middle East, and Europe.
Detection and Response
Enea spotted SilentAir by studying unusual attacks on links between operators since early 2025. The company confirmed compromised equipment inside operators by observing it both send and receive attack commands. Detecting the attacks was challenging due to the attackers' sophisticated understanding of mobile networks.
Enea has informed the affected operators and disrupted the operation, though it warns SilentAir could return. The company has not disclosed whether the hacked equipment has been fully cleaned up or if any accounts were successfully taken over.
Related
