Enea links SilentAir campaign to attacks on Asian telecoms

Stockholm-based telecoms and cyber-security firm Enea has disclosed a newly identified spying campaign, dubbed SilentAir, which compromised equipment inside at least six Asian mobile operators to intercept calls and texts for targeted individuals, with a focus on Taiwan. Enea reported that SilentAir operators used hacked network gear to inject UpdateLocation messages (or the Diameter equivalent) into the home network, making it appear as though the target’s device was being served by the attacker.

If accepted, this diverted the target’s calls and texts to the attackers and allowed some 2FA codes to be captured immediately after diversion, pointing to attempts to breach other accounts tied to those people. Enea observed that interception accounted for 18.3% of SilentAir’s attacks, compared with a 2.1% share in its earlier work on similar signaling intrusions.

The research notes that SilentAir’s activity extended beyond Taiwan, with targets across Southeast and East Asia and occasional reach into East Africa, Central Asia, the Middle East and Europe. The operation involved silent SMS messages—largely undetectable by the recipient—predominantly at night, and most often sent to Taiwan-domiciled subscribers. In some cases, multiple operators appeared to be controlled by a single operator, suggesting a centralised command structure.

While Enea linked some indicators to China with low confidence and noted a possible association with Liminal Panda, it stressed that the evidence did not conclusively tie SilentAir to that group. Enea also tracked related SCTPE-style activity and observed SilentAir exploiting a GTP-based backdoor (GTPDoor) in at least five to ten operators.

The company urged operators to deploy coordinated firewalls for GTP-C, GTP-U, SS7 and Diameter, treat IPX as untrusted, monitor signalling within their networks, and integrate signaling security with broader IT security. The report did not identify specific countries, operators or targets.