Threat watch / Campaign
SilentAir: hacked mobile operators used to divert texts and catch 2FA codes, Taiwan the main target
Telecom security company Enea says a new actor it calls SilentAir has been sending SS7 and Diameter signalling attacks from compromised network nodes inside mobile operators in at least six Asian countries, which it does not name. The attacks divert selected subscribers' calls and texts to attacker equipment; Taiwan is the primary target, among a dozen more countries and territories. Enea saw two-factor authentication codes intercepted for some targets. It assesses with high confidence that SilentAir is a state-level actor, and with low confidence that its activity aligns with China-nexus operations.
- Sector
- Tech & SaaS
- Way in
- Not public yet
- Product or vendor
- None named
- subscribers targeted in the largest month-long bursts[2]
- Several thousand
- How it happened
- Enea says the attacks are generated from compromised network nodes inside infected mobile operators and injected into the IPX, the network that links operators. The main attack is a malicious UpdateLocation message that diverts a target's calls and texts to attacker-controlled equipment. Enea does not say how the operators' equipment was first compromised.[1][2] Checked 14 Nov 2026
- What was stolen
- Calls and text messages of selected subscribers, diverted to the attackers. Enea observed two-factor authentication codes intercepted immediately after the diversion for some targets, which it says suggests attempts to access other accounts. The sources do not say whether any account was taken over.[1][2] Checked 14 Nov 2026
- Who was impacted
- Mobile operators in at least six Asian countries whose network nodes were compromised, none named, and subscribers of operators in a dozen more countries and territories, with Taiwan the primary target. The Hacker News reports bursts ranging from one or a few subscribers to several thousand over a month.[1][2] Checked 14 Nov 2026
- Threat actor
- SilentAir →
Timeline
- Enea publishes its report: it has tracked unusual SS7 and Diameter attacks from some Asian operators since early 2025, with suspicious activity even before, coming in bursts separated by months of inactivity. It names the actor SilentAir and calls it a state-level actor with high confidence, aligned with China-nexus operations with low confidence. It calls a link with the LIMINAL PANDA group possible but unconfirmed. [1]
- The Hacker News reports that Enea confirmed compromised equipment inside one operator sending and receiving attack commands, and that the China-nexus signs are a UTC+8 working-day pattern and the absence of attacks on mainland Chinese networks. [2]