A previously unknown threat actor has compromised equipment inside Asian mobile operators to intercept selected subscribers’ calls and text messages, with Taiwan the primary target, telecom security company Enea says. The company has tracked the activity since early 2025 and named the suspected state-level operation SilentAir, warning that the campaign abuses trusted mobile-network infrastructure rather than relying on direct attacks against individual phones. Enea’s research assesses the state-level characterization with high confidence. [1]
SilentAir launched malicious signaling traffic, primarily through Signaling System No. 7 (SS7) and occasionally Diameter, from compromised network nodes in at least six Asian countries. Enea observed those nodes targeting subscribers in a dozen additional countries and territories, including targets in Southeast Asia, East Asia, Central Asia, the Middle East, Europe and East Africa. Attacks ranged from individual targets to bursts involving several thousand subscribers over a month, with periods of inactivity lasting months.
The central technique was a fraudulent location update. By persuading a victim’s home network that the subscriber had moved to an attacker-controlled signaling address, SilentAir could route incoming voice calls and SMS messages through infrastructure under its control. Enea says it observed authentication and subscriber-information requests as well as limited location tracking; interception represented 18.30% of the activity it analyzed. Some targets received two-factor authentication codes immediately after interception began, suggesting an effort to gain access to other accounts, although the research does not establish that account takeovers succeeded.
The campaign also generated large volumes of “silent SMS” messages, which normally do not appear on a handset or trigger an alert. Traffic aimed at Taiwanese subscribers frequently peaked around midnight, apparently to test whether earlier interception remained active as devices re-registered with their legitimate networks. Enea said the messages were often routed through an intermediary SMS center, helping obscure their origin, and sometimes contained innocuous promotional or motivational text in case network handling exposed them to recipients.
Enea assesses with low confidence that SilentAir’s activity is aligned with China-nexus cyber operations, citing its concentration on Taiwanese targets, apparent interest in political and government figures, timing consistent with China Standard Time and the absence of observed targeting of Chinese subscribers. The company did not directly attribute the operation to the separately tracked LIMINAL PANDA group, despite overlaps in infrastructure and targeting, and said the relationship remains unconfirmed. No CVE, vendor software advisory, patch or public exploit is identified in the research; the exposure concerns abused telecom signaling trust and compromised operator nodes rather than a disclosed end-user product flaw.
Mobile operators should treat interconnect and IPX interfaces as untrusted, Enea said, and correlate SS7, Diameter and newer mobile-network traffic instead of protecting each protocol in isolation. That means filtering anomalous location updates, reviewing unexpected signaling from internal nodes, investigating silent-SMS spikes and integrating signaling telemetry with broader security monitoring. Operators should also verify the security of managed core-network environments and investigate the listed indicators, including the SCTPE sample hash da35d98c9a22e8ede93595d21fe7e63d8, while recognizing that those indicators are not proof of SilentAir attribution. [1]
