SilentAir Hackers Hijack Mobile Networks to Intercept Calls and SMS Across Asia

The cybersecurity landscape has been rocked by the discovery of a previously unknown state-level threat actor that has been silently intercepting phone calls and text messages through compromised mobile operator infrastructure. Tracked as SilentAir, the group has operated undetected since at least early 2025, with primary targets concentrated in Taiwan and dozens of other countries across Asia, East Africa, Central Asia, the Middle East, and Europe.

Inside the SilentAir Campaign

Telecom software and cybersecurity firm Enea uncovered the operation, assessing with high confidence that SilentAir is a new state-level actor. The researchers believe, with lower confidence, that the group’s activities align with China-nexus operations, based on several telling indicators: the hackers’ intense focus on Taiwan, the complete absence of Chinese targets, and attack timing that corresponds to working hours in China’s time zone.

What makes SilentAir particularly dangerous is its method of attack. Rather than targeting individual devices or applications, the group hijacks network nodes at mobile operators themselves. By compromising the infrastructure that carriers use to route traffic, SilentAir can intercept communications at the network level, making their activities virtually invisible to end users and standard endpoint security tools.

How the Interception Works

SilentAir launches signaling attacks primarily over SS7 (Signaling System No. 7) and occasionally over Diameter, the two core protocols that mobile networks use to exchange routing and subscriber information. When an attack is active, incoming calls and SMS messages destined for a target are routed through the compromised node, allowing the attackers to harvest subscriber details and communication content in real time.

The group also employs silent SMS messages, a technique where text messages are sent to a target device without displaying any notification to the recipient. These silent probes are likely used to verify whether earlier interception attempts were successful, allowing the attackers to refine their targeting over time.

While location tracking is possible through the same methods, Enea reports that it constitutes only a small fraction of SilentAir’s observed activity. The primary focus appears to be intelligence gathering through call and message interception rather than physical surveillance.

Scale and Scope of the Attack

The scale of the operation is staggering. SilentAir has compromised network nodes belonging to mobile operators in at least six Asian countries. From these hijacked nodes, the group has targeted subscribers in a dozen additional countries and territories, occasionally reaching into East Africa, Central Asia, the Middle East, and Europe.

High-profile political and government figures were among those targeted, suggesting that SilentAir’s mission is firmly rooted in state-sponsored espionage rather than financial cybercrime. The ability to intercept calls and messages of political leaders represents a significant national security threat, potentially exposing diplomatic communications, strategic deliberations, and sensitive personal information.

Liminal Panda: A Related Threat

Enea’s report also highlights continued activity from Liminal Panda, another threat actor that CrowdStrike previously linked to China-nexus operations. Liminal Panda is notable for being the only known group that actively exploits the IPX, the interconnect network that mobile operators use to exchange traffic globally.

Starting in the first quarter of 2026, Enea detected and blocked Liminal Panda’s GTPDoor backdoor at several mobile operator customers. The firm recorded several hundred attempts to covertly reach command-and-control servers through this backdoor. Enea estimates that between five and ten operators may have been infected, with the total potentially reaching several dozen across Asia, Africa, and Latin America.

While Enea notes that SilentAir and Liminal Panda could be connected, the evidence remains insufficient to definitively link the two groups. However, their overlapping focus on telecom infrastructure and similar geographic targeting patterns suggest at minimum a shared operational ecosystem.

Why Mobile Network Security Matters More Than Ever

The SilentAir revelations underscore a critical but often overlooked dimension of cybersecurity. While much of the industry’s attention focuses on endpoint threats, ransomware, and application-level vulnerabilities, the underlying telecom infrastructure that carries global communications remains a soft target for sophisticated adversaries.

• SS7 and Diameter vulnerabilities have been known for years, but many operators have been slow to implement adequate protections, leaving gaps that state actors can exploit.
• Network node compromise allows attackers to bypass device-level encryption entirely, intercepting metadata and communication routing data before it reaches the end user.
• Silent SMS techniques can confirm whether a target’s communications are being successfully routed through a compromised node, enabling precise targeting over extended periods.
• Cross-border infrastructure means a compromised operator in one country can be used to intercept communications of subscribers in many other nations.

Protecting Against Network-Level Interception

For organizations and individuals concerned about state-level telecom surveillance, traditional cybersecurity measures are insufficient. The following strategies can help mitigate the risk of network-level interception:

End-to-end encrypted communications represent the most effective defense against SS7-based interception. Applications that encrypt content on the device before transmission ensure that even if calls or messages are intercepted at the network level, the content remains unreadable to the attacker.

Carrier-grade signaling firewalls are becoming essential for mobile operators themselves. These systems monitor SS7 and Diameter traffic for anomalous patterns, blocking suspicious signaling requests before they can be used to intercept communications or track subscriber locations.

Regular security audits of telecom infrastructure are critical for identifying compromised nodes. Enea’s discovery that SilentAir had been active since early 2025, with suspicious activity predating even that, demonstrates how long network compromises can persist without detection.

Government and high-profile targets should assume that traditional cellular communications may be compromised and adopt secure communication protocols that do not rely on SS7-based routing for sensitive conversations.

The Broader Implications

The SilentAir campaign arrives at a time when geopolitical tensions are increasingly spilling into the digital domain. The targeting of Taiwanese subscribers, in particular, reflects the growing intersection of state intelligence operations and telecommunications infrastructure in regions where territorial disputes and political influence campaigns are active.

Moreover, the connection to the IPX network through Liminal Panda demonstrates how the interconnect fabric that links global mobile operators can be weaponized. With potentially dozens of operators compromised across multiple continents, the threat extends far beyond any single bilateral conflict.

As Enea and other telecom security firms continue to investigate, the SilentAir campaign serves as a stark reminder that the security of our most fundamental communication infrastructure cannot be taken for granted. Mobile network operators, governments, and enterprises must treat telecom infrastructure security with the same urgency as application security, endpoint protection, and cloud security.

The discovery also highlights the critical role that specialized telecom cybersecurity firms play in detecting threats that traditional IT security tools cannot see. Without Enea’s deep expertise in signaling protocols and mobile network architecture, SilentAir might have continued its silent interception campaign for years to come.

What Comes Next

For mobile operators, the SilentAir report should serve as an immediate catalyst for reviewing signaling security controls and auditing network nodes for signs of compromise. For enterprises, particularly those operating in targeted regions, the campaign reinforces the need to mandate encrypted communication tools for executives, government liaisons, and employees handling sensitive information.

The cybersecurity community will be watching closely to see whether SilentAir’s exposure leads to changes in the group’s tactics or whether the operators will attempt to rebuild their infrastructure under new cover. What is certain is that the era of treating mobile network infrastructure as inherently trusted is over. In 2026 and beyond, the security of the signaling layer must be treated as a first-class concern in every organization’s threat model.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous