Enea disclosed SilentAir on Nov. 11, describing a state-level spying operation with high confidence and assessing a possible China connection with low confidence; it has tracked the activity since early 2025, with signs it began earlier.

The group compromised equipment inside mobile operators in at least six Asian countries, then used trusted IPX links and forged SS7 or Diameter signaling messages to divert subscribers’ calls and texts through attacker-controlled systems.

SilentAir’s targets have included subscribers in Taiwan and a dozen other countries and territories, particularly political and government figures; attacks came in bursts ranging from a handful of people to several thousand in a month.

Interception made up 18.3% of SilentAir’s observed activity, compared with 2.1% for a typical commercial surveillance firm in Enea’s earlier research, and equipment in multiple countries sometimes coordinated against the same target.

For some targets, Enea saw SMS two-factor authentication codes intercepted soon after diversions began, suggesting attempts to reach accounts tied to their phone numbers; it found no evidence of voice interception or confirmed account takeovers.

SilentAir also sent large volumes of silent SMS, mainly to Taiwanese subscribers; messages to other networks during the day appeared to test whether diversions worked, while the purpose of mostly nighttime messages to Taiwan remains unclear.

The attacks are invisible to subscribers: diverted messages simply fail to arrive, with no warning or change in service, because the compromise happens inside carrier networks and cannot be fixed on a user’s device.

Enea traced the activity to compromised operator equipment that sent and received attack commands, but said the attacks were difficult to detect and block and that it could not analyze the suspected malware.

Enea’s low-confidence China assessment draws on SilentAir’s focus on Taiwan and activity timing consistent with China’s workday; a possible connection to Liminal Panda remains unconfirmed.

Enea says SilentAir is disrupted for now but could return; it notified affected operators, but has not confirmed compromised equipment was cleaned up and did not name the operators, countries or targets.

Enea recommends that operators coordinate GTP-C and GTP-U firewalls with SS7 and Diameter defenses, treat the IPX as untrusted, monitor signaling inside their networks and connect telecom security with broader IT defenses.

Separately, Enea reported blocking Liminal Panda’s GTPDoor traffic at several customer operators and finding infections or strong signs of infection at five to 10 operators; it also found a version that can hide commands in GTP-U traffic.