Enea Details SilentAir Activity Intercepting Calls and SMS Through Compromised Mobile Networks
Summary
Enea says SilentAir uses hijacked mobile-operator nodes to intercept calls and SMS, mainly targeting Taiwan. It assesses the group is a new state-level actor with high confidence, but its possible China alignment with low confidence.
Key points
- SilentAir routes targets’ incoming calls and SMS through hijacked mobile-operator nodes, mostly using SS7 and sometimes Diameter, and harvests subscriber details.
- Enea says location tracking is a small part of SilentAir’s activity; the group also sends silent SMS messages, possibly to check whether interception succeeded.
- Enea has monitored SilentAir since early 2025 and found signs of earlier activity; hijacked nodes belong to operators in at least six Asian countries.
- SilentAir has targeted Taiwan and a dozen other countries and territories, including high-profile political and government figures.
- Enea assesses with high confidence that SilentAir is a new state-level actor, but only with low confidence that its activity aligns with China-nexus operations.
- Enea says it blocked several hundred attempts to reach command-and-control servers involving Liminal Panda’s GTPDoor backdoor in 2026, and estimates potential infections at five to ten operators, possibly more.
Article Details
- Event Type
- Mobile-network intrusion and surveillance activity attributed to SilentAir, alongside reported 2026 IPX exploitation by Liminal Panda.
- Impact
- SilentAir reportedly routes targets’ incoming calls and SMS messages through hijacked mobile-operator network nodes to intercept communications and harvest subscriber details. It can also track targets’ locations and send silent SMS messages. High-profile political and government figures were among those targeted, with Taiwan identified as the main target. Separately, Enea reported blocking several hundred attempts by Liminal Panda’s GTPDoor backdoor to reach command-and-control servers and estimated potential infections at five to ten operators, possibly more; those figures are estimates, and the article says evidence is insufficient to link the two groups.
Threat Actors
Liminal PandaEnea reported that Liminal Panda actively exploited IPX and that its GTPDoor backdoor attempted to reach command-and-control servers. CrowdStrike linked the group to China-nexus operations with low confidence. Enea said evidence was insufficient to link Liminal Panda with SilentAir.SilentAirEnea attributes mobile-network signaling attacks, communication interception, and subscriber-data harvesting to SilentAir. Enea assesses with high confidence that it is a new state-level actor, but its proposed alignment with China-nexus operations is low confidence.