Enea links SilentAir to attacks intercepting Taiwanese calls

A new state-level actor, identified as SilentAir by Enea, has used compromised Asian mobile operators to intercept calls and texts, with Taiwan as the primary target. Enea has monitored the activity since early 2025 and notes that SilentAir conducted Signalling System No. 7 (SS7) and Diameter attacks from hijacked operator equipment across at least six Asian countries, impacting subscribers in about a dozen more.

The group’s operations occurred in waves, ranging from tens of subscribers to several thousand per month, with intermittent quiet periods. Intercepted communications accounted for around 18.30% of SilentAir’s activity, compared with 2.07% for the surveillance-focused actors behind most signaling attacks.

In some cases, two-factor authentication (2FA) codes arrived moments after interception began, suggesting an aim to access other accounts, while a large portion of activity consisted of silent SMS messages sent to Taiwanese users around midnight. Enea linked SilentAir to China-nexus operations with low confidence, citing Taiwan focus, few Chinese targets, working hours in China’s time zone, and lulls during Chinese holidays; some targets were political or government VIPs.

In parallel, Enea detected and blocked GTPDoor and related Liminal Panda activity at several customer operators from early 2026, observing hundreds of attempted command-and-control (C2) exchanges. GTPDoor is a Unix backdoor that hides C2 traffic in the GPRS Tunnelling Protocol (GTP), which carries roaming data. Enea reported at least five to ten operators infected by Liminal Panda, with the possibility that the actual number was higher and concentrated in Asia, Africa and Latin America.

A new GTPDoor version riding on GTP-U—the user data-carrying portion of the protocol—was identified; Enea suggested this variant serves mainly as a fallback and travels into 5G networks. CrowdStrike linked Liminal Panda to China-nexus operations in November 2024, albeit with low confidence. Enea said it helped customers remove Liminal Panda and SilentAir sources and warned that conditions remain for their return.