SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks
A previously unknown threat actor called SilentAir has been intercepting phone calls and text messages by compromising mobile operator infrastructure, with Taiwan as its primary target.
Telecom cybersecurity company Enea has identified a new state-level threat actor called SilentAir that intercepts calls and SMS by compromising mobile operator infrastructure. The group primarily targets Taiwan, with researchers assessing with high confidence that it's a state-level actor.
SilentAir launches signaling attacks over SS7 and sometimes Diameter protocols from hijacked network nodes at mobile operators. These attacks route targets' incoming communications through the compromised node, allowing the hackers to harvest subscriber details.
The hackers can also track a target's location, but this makes up only a small part of their activity. They send silent SMS messages, which don't appear on the recipient's phone, possibly to check whether earlier interception attempts succeeded.
Global Reach
Enea has monitored SilentAir's activity since early 2025, though suspicious activity predates this. The hijacked nodes belong to operators in at least six Asian countries, with the group targeting over a dozen other countries and territories worldwide.
High-profile political and government figures were among those targeted, with occasional attacks on people in East Africa, Central Asia, the Middle East and Europe. The group's interest in Taiwan and absence of Chinese targets suggests alignment with China-nexus operations.
Related Threats
Enea also documented activity from Liminal Panda, a group linked with low confidence to China-nexus operations. This group is the only known actor actively exploiting IPX, the interconnect network mobile operators use to exchange traffic.
Related
