A newly discovered cyber espionage operation has targeted telecommunications networks across Asia, allowing attackers to intercept phone calls and text messages belonging to selected individuals, particularly users in Taiwan.
The hacking group, identified as SilentAir, reportedly compromised telecommunications infrastructure belonging to mobile network operators in at least six Asian countries and used the access to intercept communications and monitor targeted subscribers.
Stockholm-based telecommunications and cybersecurity company Enea uncovered the operation and disclosed its findings on November 13, 2026.
Enea assessed with high confidence that SilentAir is a state-level cyber espionage actor, although it expressed only low confidence in its suspected connection to China.
The company said it had notified affected telecommunications operators about the compromised infrastructure and disrupted the group’s activities for now. However, it warned that the attackers could return. Its report did not establish whether all affected operators had completely removed the compromised equipment.
How SilentAir infiltrated telecommunications networks
Mobile network operators depend on signalling protocols such as Signalling System No. 7 (SS7) and Diameter to exchange information required for call routing, text messaging and international roaming.
These protocols operate across a shared telecommunications infrastructure known as the IP Exchange (IPX), which relies heavily on trust between participating operators.
SilentAir exploited this trusted environment by using compromised equipment inside legitimate mobile networks to inject malicious signalling messages into the IPX infrastructure.
For communication interception, the attackers sent UpdateLocation messages, or their Diameter equivalents, to the targeted subscribers’ home networks.
These messages falsely indicated that the compromised equipment was now serving the targeted phone numbers.
When a subscriber’s home network accepted the fraudulent request, incoming calls and text messages could be redirected to infrastructure controlled by the attackers instead of reaching the intended device.
Enea confirmed that some of these interception attempts succeeded. In certain cases, the company observed SMS-based two-factor authentication (2FA) codes being intercepted immediately after the fraudulent redirection took effect.
The activity suggests that the attackers may have been attempting to access additional online accounts belonging to the targeted individuals.
However, Enea did not provide evidence of successful voice-call interception or confirm whether any online accounts were ultimately taken over.
The company noted that interception represented 18.3 per cent of the attacks attributed to SilentAir. This was significantly higher than the 2.1 per cent interception rate previously observed among typical surveillance companies involved in signalling attacks.
Some of the targets were political and government officials considered high-profile individuals in their respective countries.
In a small number of cases, compromised telecommunications equipment in multiple countries coordinated attacks against the same targets, suggesting that the operations were controlled by a central authority.
Attacks concentrated on Taiwan and other Asian countries
Enea observed that SilentAir conducted its operations in irregular bursts, with attacks ranging from a small number of subscribers to several thousand targets within a month.
The activity was sometimes separated by periods of inactivity lasting several months or longer.
Although Taiwan accounted for most of the identified targets, the group also focused on subscribers across Southeast and East Asia. Other victims were identified in East Africa, Central Asia, the Middle East and Europe.
Enea cautioned that subscribers using the compromised operators’ own networks may also have been targeted, but the company could not observe that particular traffic.
Investigators identified SilentAir by monitoring signalling attacks occurring across connections between telecommunications operators.
Since early 2025, Enea had been tracking unusual SS7 attacks, alongside some Diameter-based activity, originating from certain Asian operators that would not normally be expected to generate such malicious traffic.
Further investigations revealed suspicious activity dating back even earlier.
The company’s analysis found that networks hosting SilentAir infrastructure handled follow-up signalling messages associated with redirected subscribers in unusual and inconsistent ways.
Initially, investigators considered two possible explanations: external attackers were impersonating the signalling addresses of legitimate networks, or the operators’ internal equipment had been compromised.
The second explanation was confirmed after Enea discovered equipment within one operator’s network both transmitting and receiving attack commands. The equipment displayed the same behaviour as SilentAir infrastructure identified in other telecommunications networks.
Enea said detecting and blocking the operation was initially difficult because the attackers demonstrated considerable knowledge of mobile network architecture and signalling security mechanisms.
Following containment, investigators recovered evidence of unauthorised access but were unable to analyse the malware believed to have been used by the group.
Silent SMS used to monitor targeted subscribers
Beyond intercepting calls and conventional text messages, SilentAir also transmitted large volumes of silent SMS messages, particularly to subscribers in Taiwan.
Silent SMS messages are specially configured texts that do not generate visible notifications or alerts on recipients’ mobile phones.
Enea observed that daytime silent SMS activity was largely directed at subscribers on other telecommunications networks, including operators in Southeast Asia.
The company believes these messages were primarily used to determine whether previously established call and text redirections were functioning properly.
If a test message reached the compromised equipment instead of the subscriber’s actual phone, the attackers could establish that interception remained active.
Most of the silent SMS traffic was transmitted at night, with a significant proportion directed at Taiwanese subscribers.
The precise purpose of the nighttime activity remains unclear. However, Enea suggested that the messages could have been used to check whether previously established redirections were still active.
This may have been particularly useful at night because mobile phones are generally less likely to reconnect to their legitimate network location during periods when users are not moving around.
The messages also contained promotional or motivational statements resembling ordinary spam, often written in English.
Enea believes these messages were deliberately designed as camouflage. If a telecommunications operator removed the silent-message configuration while processing the texts, recipients would see ordinary promotional messages and might simply ignore them.
Possible links to China-backed cyber espionage
Although Enea assessed SilentAir as a likely state-level actor, its attribution to China remains tentative.
The company based its assessment partly on the group’s apparent focus on Taiwan while avoiding Chinese telecommunications networks and subscribers.
Investigators also identified operational patterns consistent with China’s standard working hours.
SilentAir’s tracking and interception activities generally began around 9 a.m. in the UTC+8 time zone, slowed considerably during weekends and experienced interruptions or reduced activity around Chinese public holidays.
Enea also examined a possible relationship between SilentAir and Liminal Panda, a cyber espionage group previously associated with intrusions into telecommunications infrastructure.
However, the company stressed that the connection remains unconfirmed.
In some compromised operators, SilentAir activity occurred while infections associated with Liminal Panda were also present. At other times, investigators found no evidence that the groups were cooperating.
Both groups targeted telecommunications operators in parts of Asia, although Liminal Panda has not been identified as having the same specific focus on Taiwan.
Connections to SCTPE and SIGweaver malware
SilentAir’s operational techniques also showed similarities to SCTPE, a relatively obscure Linux-based trojan designed to operate within the operating system’s kernel and transmit or receive SS7 and Diameter signalling traffic.
Singapore’s Infocomm Media Development Authority (IMDA) previously described a similar tool in a government cybersecurity advisory, referring to it as SIGweaver.
According to the advisory, CrowdStrike identified the tool on January 21 and linked it to Liminal Panda with moderate confidence.
However, Enea identified an important difference between SilentAir and the known SCTPE malware.
The compromised infrastructure associated with SilentAir responded to certain messages that it had not transmitted itself, a capability that the known SCTPE programme does not support.
Enea also observed that SilentAir demonstrated considerably stronger operational security than Liminal Panda.
Separately, the company reported detecting Liminal Panda activity through its GTP firewall at several customer telecommunications operators since the first quarter of 2026.
It said it blocked GTPDoor traffic associated with the group and identified infections, or strong indications of compromise, across at least five to 10 operators.
The GTPDoor backdoor, first documented in February 2024, conceals malicious commands inside GTP-C, a protocol used to establish mobile data connections between networks.
Enea also discovered evidence of a newer version capable of hiding commands inside GTP-U, which carries actual user data across mobile networks.
Because GTP-U traffic is more difficult to inspect, the newer version presents additional monitoring challenges. However, Enea believes the capability may primarily serve as a backup communication method.
Security recommendations for telecommunications operators
Following its investigation, Enea warned that the techniques used by SilentAir could potentially be adopted by other cyber espionage groups.
The company advised telecommunications operators to strengthen their network security by deploying both GTP-C and GTP-U firewalls and ensuring that these systems share threat information with existing SS7 and Diameter security infrastructure.
It also recommended going beyond basic industry signalling-security requirements and treating the entire IPX environment as untrusted rather than assuming that communications from connected operators are automatically safe.
Additional recommendations include deploying systems capable of detecting suspicious signalling activity within internal networks and integrating telecommunications security monitoring with broader corporate IT security operations.
Enea’s findings highlight the growing risks facing telecommunications infrastructure, particularly as attackers increasingly exploit trusted connections between mobile network operators to conduct surveillance, intercept verification messages and potentially gain access to sensitive accounts.
The company did not identify the affected countries, telecommunications operators or individuals targeted by SilentAir. It also did not provide specific advice for mobile subscribers who may have been affected by the interception campaign.