GTPDoor

SilentAir APT Intercepts Calls and SMS via Hijacked Mobile Network Nodes, Primarily Targeting Taiwan

Enea has uncovered a previously unknown threat actor tracked as SilentAir that compromises mobile operator infrastructure to intercept phone calls and text messages. The group primarily targets Taiwan and has also hit victims across a dozen other countries and territories in Asia, East Africa, Central Asia, the Middle East, and Europe. Researchers assess with high confidence that SilentAir is a new state-level actor and assess with low confidence that its operations align with China-nexus activity based on targeting patterns and working-hour timing. The attackers launch signaling attacks over SS7 and sometimes Diameter from hijacked network nodes, routing incoming calls and SMS through the compromised infrastructure to harvest subscriber data and track locations. Enea has observed the activity since early 2025, with evidence of earlier operations, and notes that SilentAir occasionally sends silent SMS messages to verify interception success. The report also covers separate 2026 activity by Liminal Panda, which exploits the IPX interconnect network and deploys the GTPDoor backdoor against mobile operators.

Enea Identifies SilentAir Espionage Group Compromising Asian Telecom Networks to Intercept SMS 2FA Codes

Enea has uncovered a sophisticated espionage operation attributed to the SilentAir group, which compromised equipment inside mobile operators across at least six Asian countries. The attackers used SS7 and Diameter signaling protocols over the IPX network to send fraudulent UpdateLocation messages, diverting calls and texts of selected targets, primarily in Taiwan. Interception accounted for 18.3 percent of observed activity, far exceeding typical surveillance operations, and included real-time capture of two-factor authentication codes. SilentAir also generated large volumes of silent SMS messages to verify diversions and maintain persistence, with activity patterns aligning to China Standard Time working hours. While Enea assesses the actor as state-sponsored with high confidence, links to China remain low-confidence, and possible ties to Liminal Panda or the SCTPE/SIGweaver tool are unconfirmed. The company has notified affected operators and recommends deploying integrated GTP, SS7, and Diameter firewalls along with treating the entire IPX as untrusted.