SilentAir: Asian telecom SS7/Diameter signaling compromise — state-linked actor hijacked mobile networks to intercept SMS 2FA codes and spy on Taiwan targets
Severity: high · Patch status: no-fix-needed · Since 2026-11-13
Enea identified SilentAir, a state-level (low-confidence China-linked) espionage group that compromised equipment inside mobile operators in at least six Asian countries to launch SS7 and Diameter signaling attacks over the IPX. Using UpdateLocation-style messages, it diverted calls and texts of selected targets—mostly in Taiwan, including political and government VIPs—and in some cases intercepted 2FA codes immediately after diversion, indicating attempted account takeover. It also sent mass silent SMS, mainly to Taiwan subscribers at night, likely to verify diversions. Activity followed China Standard Time working hours and paused on weekends and Chinese holidays. Possible but unconfirmed links to Liminal Panda and the SCTPE/SIGweaver trojan. Operators were notified and SilentAir is disrupted for now, but cleanup status is unconfirmed and it could return.
What to do
- Audit SS7/Diameter and GTP signaling for unauthorized UpdateLocation/diversion messages and unexpected foreign-origin traffic
- Deploy or tune signaling firewalls to block spoofed home-network routing addresses and anomalous UpdateLocation and silent-SMS bursts
- Verify and remediate any compromised internal network equipment; confirm no residual malware or unauthorized access
- Monitor for 2FA-code interception patterns and force re-authentication or credential resets for potentially targeted subscribers
- Share indicators with GSMA, national CERTs, and peers; validate roaming-partner trust boundaries on the IPX
Sources
All live incidents on Threat Watch
