SilentAir APT Intercepts Calls and SMS via Hijacked Mobile Network Nodes, Primarily Targeting Taiwan

Enea has uncovered a previously unknown threat actor tracked as SilentAir that compromises mobile operator infrastructure to intercept phone calls and text messages. The group primarily targets Taiwan and has also hit victims across a dozen other countries and territories in Asia, East Africa, Central Asia, the Middle East, and Europe. Researchers assess with high confidence that SilentAir is a new state-level actor and assess with low confidence that its operations align with China-nexus activity based on targeting patterns and working-hour timing. The attackers launch signaling attacks over SS7 and sometimes Diameter from hijacked network nodes, routing incoming calls and SMS through the compromised infrastructure to harvest subscriber data and track locations. Enea has observed the activity since early 2025, with evidence of earlier operations, and notes that SilentAir occasionally sends silent SMS messages to verify interception success. The report also covers separate 2026 activity by Liminal Panda, which exploits the IPX interconnect network and deploys the GTPDoor backdoor against mobile operators.

SecurityWeekNovember 13, 2026Translated from English

Read at source

Enea has detailed the activity of a previously unknown threat actor that intercepts phone calls and text messages through compromised mobile operator infrastructure, with Taiwan as its main target.

The company tracks the group as SilentAir and assesses with high confidence that it is a new state-level actor. Enea researchers also believe, with low confidence, that SilentAir activity is aligned with China-nexus operations. Their reasons include the hackers interest in Taiwan, the absence of Chinese targets, and attack timing consistent with a workday in Chinas time zone.

SilentAir launches its signaling attacks, mostly over SS7 and sometimes over Diameter, from network nodes it has hijacked at mobile operators. The attacks route a targets incoming calls and SMS messages through the compromised node and harvest subscriber details. The hackers can also track a targets location, but this makes up only a small part of their activity. They send silent SMS messages, which do not appear on the recipients phone, possibly to check whether earlier interception attempts succeeded.

Enea has monitored the attacks since early 2025, and further digging revealed suspicious activity from before that. The hijacked nodes belong to operators in at least six Asian countries. Besides Taiwan, the group has targeted a dozen other countries and territories, occasionally going after people in East Africa, Central Asia, the Middle East and Europe. High-profile political and government figures were among those targeted.

The report also covers 2026 activity from Liminal Panda, a group that CrowdStrike linked, with low confidence, to China-nexus operations. Enea says it is the only actor known to actively exploit the IPX, the interconnect network that mobile operators use to exchange traffic. Starting in the first quarter of 2026, Enea spotted and blocked Liminal Panda GTPDoor backdoor at several of its mobile operator customers. In total, it caught several hundred attempts to covertly reach command-and-control servers. Enea says it has seen potential infections at between five and ten operators. It estimates that the total could reach several dozen, particularly in Asia, Africa and Latin America.

According to Enea, SilentAir and Liminal Panda could be connected, although the evidence is not strong enough to link them.

CrowdStrike SilentAir Enea Liminal Panda GTPDoor

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in APT & Nation-State

APT & Nation-State

Enea Identifies SilentAir Espionage Group Compromising Asian Telecom Networks to Intercept SMS 2FA Codes

Enea has uncovered a sophisticated espionage operation attributed to the SilentAir group, which compromised equipment inside mobile operators across at least six Asian countries. The attackers used SS7 and Diameter signaling protocols over the IPX network to send fraudulent UpdateLocation messages, diverting calls and texts of selected targets, primarily in Taiwan. Interception accounted for 18.3 percent of observed activity, far exceeding typical surveillance operations, and included real-time capture of two-factor authentication codes. SilentAir also generated large volumes of silent SMS messages to verify diversions and maintain persistence, with activity patterns aligning to China Standard Time working hours. While Enea assesses the actor as state-sponsored with high confidence, links to China remain low-confidence, and possible ties to Liminal Panda or the SCTPE/SIGweaver tool are unconfirmed. The company has notified affected operators and recommends deploying integrated GTP, SS7, and Diameter firewalls along with treating the entire IPX as untrusted.

The Hacker NewsNov 13, 2026Translated from English

APT & Nation-State

Threat Actors Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and destroy_v6 Wiper on ESXi Hosts

An unknown threat actor has been targeting unpatched Check Point Security Gateways since October 30, 2026, initially exploiting PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 to gain access via Mobile Access portals. Attackers then leveraged the local privilege escalation flaw CVE-2026-123039 in Gaia OS DynamicCLI to escalate from the portal service account to root and deploy PHP web shells along with the persistent TSGA backdoor and its TSProxy networking component. The campaign first hit Israeli organizations before expanding on November 2, 2026, to targets across multiple countries and sectors without clear geographic focus. In several cases the actors pivoted via SSH to VMware ESXi hosts, deployed the destroy_v6 wiper malware that recursively overwrites and deletes files, and left politically themed DREAM_ANNEXATION.txt notes. TSGA and TSProxy are assessed as Check Point-specific elements of the PhiliKit toolkit previously linked by ESET to the China-nexus group Armory Castle (formerly UNC5221). Check Point notes insufficient evidence to attribute the full operation with high confidence and lists possible scenarios including initial-access brokerage or false-flag activity.

The Hacker NewsNov 13, 2026Translated from English

APT & Nation-State

Turla APT Deploys Modular Cereal Malware Framework to Harvest Emails from Microsoft Exchange Servers

The Russia-aligned threat actor Turla has been observed deploying a previously undocumented modular toolset called Cereal against government Exchange servers in Kazakhstan and Romania. The framework enables long-term stealthy email collection by abusing compromised Microsoft Exchange instances as internal C2 hubs without any external infrastructure. ESET researchers detailed how Cereal components run in memory, inject into EdgeTransport.exe, and filter messages containing DOC, DOCX or PDF attachments based on hardcoded sender, recipient, subject and attachment rules. In the Romanian incident the malware was configured to target NATO and European Union-related addresses. Commands are delivered as compiled .NET assemblies that CerealRunner executes in memory, supporting Active Directory enumeration, WMI queries, LSA Secrets extraction and file operations. The absence of disk artifacts and the use of serialization throughout the eight-component framework highlight Turla’s deep knowledge of Exchange internals.

The Hacker NewsNov 10, 2026Translated from English