SilentAir Used Compromised Telecom Equipment to Intercept SMS 2FA Codes
Summary
Enea says the SilentAir group used compromised equipment at Asian mobile operators to divert calls and texts, intercept some SMS 2FA codes and send mass silent SMS, mainly to Taiwan. Enea assesses state-level activity with only low-confidence China ties.
Key points
- Enea traced SilentAir attacks to compromised equipment in mobile operators across at least six Asian countries; it assesses the actor as state-level with high confidence, but links it to China with low confidence.
- SilentAir sent SS7 or Diameter UpdateLocation messages to make a target's home network treat attacker-controlled equipment as the serving network, diverting calls and texts when accepted.
- Enea observed some SMS 2FA codes intercepted immediately after diversions took effect; it reported no evidence that accounts were taken over and no similar evidence for intercepted voice calls.
- SilentAir sent large volumes of silent SMS, mainly to subscribers in Taiwan. Enea says some daytime messages may have tested diversions; the purpose of many nighttime messages is unconfirmed.
- Enea confirmed compromised equipment inside one operator was sending and receiving attack commands, and later recovered traces of unauthorized access. It could not analyze the malware it believes was used.
- Enea said the activity was disrupted, but its report does not establish whether operators cleaned up the compromised equipment.
- A connection to Liminal Panda and similarities to SCTPE/SIGweaver remain uncertain; separately, Enea reported blocking Liminal Panda GTPDoor activity and finding evidence of a version using GTP-U.
Article Details
- Attack Vectors
- SilentAir sent SS7 or Diameter UpdateLocation messages through compromised equipment inside mobile operators, claiming the equipment was serving a target and diverting the target's calls and texts.
- For some targets, diverted SMS messages exposed two-factor authentication codes. Enea also observed SilentAir sending silent SMS, apparently to check whether diversions were working or remained in place; the purpose of some nighttime messages was unconfirmed.
- Enea reported separate Liminal Panda activity involving GTPDoor, which hides commands in GTP-C and, in a newer version, GTP-U.
- Defensive Notes
- Enea said it notified operators about the locations of SilentAir sources and that the activity had been disrupted for the time being; the report did not establish whether operators had cleaned up the compromised equipment.
- Enea said it blocked Liminal Panda's GTPDoor traffic at several customer operators. The report did not provide further defensive recommendations.
MITRE ATT&CK
T1111 · Multi-Factor Authentication InterceptionEnea observed SMS 2FA codes being intercepted for some targets after SilentAir diverted their messages.T1584.008 · Network DevicesEnea said compromised equipment inside mobile operator networks sent and received attack commands and was used as a source for SilentAir's attacks.
Threat Actors
Liminal PandaEnea reported detecting Liminal Panda activity at customer operators, including GTPDoor traffic and infections or strong signs of infection in at least 5 to 10 operators. Enea described a connection between Liminal Panda and SilentAir as possible but unconfirmed.SilentAirEnea named the group and assessed with high confidence that it was a state-level actor. It reported that SilentAir used compromised equipment inside Asian mobile operators to divert calls and texts, intercept some SMS 2FA codes, and send silent SMS. Enea linked the activity to China only with low confidence.
Malware
GTPDoorat several customer operators since the first quarter of this year. The company blocked the group's GTPDoor traffic there and saw Liminal Panda infections, or strong signs of them, in at least 5 to 10 operators.SCTPESilentAir's behavior also partly matches that of SCTPE, a little-known Linux trojan that runs in the kernel and is designed to send and receive SS7 and Diameter traffic.
Vendors
CrowdStrikedescribed the same tool in a government advisory. There, the tool is called SIGweaver. The agency said CrowdStrike identified it on January 21 and links it to Liminal Panda with moderate confidence.EneaEnea, a telecom and cybersecurity software company based in Stockholm, found the group's attack sources in at least six Asian countries and named it SilentAir this week. It assessed with high confidence that SilentAir
Tools
Countries
Chinaweek. It assessed with high confidence that SilentAir is a state-level actor, but linked its activity to China only with low confidence.TaiwanA newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan.