A state-level actor identified as SilentAir has compromised mobile operators across Asia to intercept calls and text messages, primarily targeting subscribers in Taiwan, as first reported by Infosecurity Magazine.
Software firm Enea has tracked SilentAir since early 2025, noting the group utilizes Signaling System No. 7 and Diameter attacks from hijacked equipment in at least six Asian countries. The actor targets individuals in a dozen territories, with interception accounting for 18% of its activity. Many attacks involve two-factor authentication codes, suggesting an intent to breach secondary accounts, while silent SMS messages are frequently sent to Taiwanese users during midnight hours. Enea researchers noted that the group's operational patterns, including working hours and holiday lulls, align with China, though they expressed low confidence in a formal link. Separately, Enea identified increased activity from Liminal Panda, a group utilizing the GTPDoor backdoor to hide command-and-control traffic within roaming data. Liminal Panda has infected at least five to 10 operators across Asia, Africa and Latin America. While Enea has assisted in clearing these threats, the firm warns that the underlying vulnerabilities in global telecommunications infrastructure remain, leaving the door open for future incursions by these or similar actors.
Source: Infosecurity Magazine
