SilentAir Hijacks Asian Mobile Networks to Intercept Calls and Texts

Enea has detailed the activity of a previously unknown threat actor, dubbed SilentAir, which hijacks mobile operator infrastructure to intercept calls and text messages. The researchers say the group primarily targets Taiwanese subscribers and operates by compromising network nodes within operators in at least six Asian countries.

SilentAir conducts signaling attacks—mainly over SS7 and occasionally Diameter—routing a target’s incoming calls and SMS messages through the compromised node to harvest subscriber details. The attackers can also track a target’s location, though that makes up only a small portion of their activity. They are observed sending silent SMS messages that do not appear on the recipient’s device, potentially to verify whether earlier interception attempts were successful. These findings come from Enea, which has monitored the activity since early 2025 and notes evidence of related activity predating that period.

Enea reports SilentAir and a second actor, Liminal Panda, a China-nexus linked group observed in 2026, with potential connections between the two but not conclusive. The hijacked nodes are linked to operators in six Asian countries; beyond Taiwan, other targets span roughly a dozen countries and territories, including East Africa, Central Asia, the Middle East and Europe, with high-profile political and government figures among those affected.

In 2026, Enea identified and blocked Liminal Panda’s GTPDoor backdoor at several operator customers, noting hundreds of covert attempts to reach command-and-control servers. While Enea estimates infections at five to ten operators, the total could reach several dozen, and it flags that SilentAir and Liminal Panda could be connected, though the evidence remains inconclusive.