What's Happening?
A previously unknown threat actor, tracked as SilentAir by telecom software and cybersecurity company Enea, is actively intercepting phone calls and text messages by compromising mobile operator infrastructure. Enea assesses with high confidence that
SilentAir is a new state-level actor, with Taiwan being its primary target. The hackers launch signaling attacks, primarily over SS7 and sometimes Diameter protocols, from hijacked network nodes within mobile operators. These attacks reroute a target's incoming calls and SMS messages through the compromised node, allowing the hackers to harvest subscriber details. While location tracking is also possible, it constitutes a smaller portion of their activity. SilentAir also sends 'silent SMS messages' that do not appear on the recipient's phone, likely to verify the success of earlier interception attempts. Enea has been monitoring these attacks since early 2025, with evidence suggesting activity predates this period. The hijacked nodes are located in at least six Asian countries, and targets include high-profile political and government figures across a dozen countries and territories, including East Africa, Central Asia, the Middle East, and Europe.
Why It's Important?
This sophisticated cyber espionage campaign poses a significant threat to national security and individual privacy, particularly for high-profile political and government figures. The ability of state-level actors to intercept calls and SMS messages from within mobile networks bypasses many traditional security measures, making communications vulnerable. The targeting of Taiwan, in particular, suggests geopolitical motivations and highlights the ongoing cyber warfare landscape. The compromise of mobile operator infrastructure indicates a deep level of access and technical capability, raising concerns about the integrity of global telecommunications networks. For the U.S. and its allies, this means that sensitive communications, even those seemingly secure, could be at risk, necessitating enhanced cybersecurity protocols and intelligence sharing to counter such advanced persistent threats.
What's Next?
Enea's researchers, with low confidence, believe SilentAir's activities align with China-nexus operations, citing interest in Taiwan, absence of Chinese targets, and attack timing consistent with a Chinese workday. This assessment will likely lead to increased scrutiny and intelligence efforts to definitively attribute the attacks. Mobile operators globally, especially those with compromised nodes, will need to enhance their network security to prevent further exploitation. Governments and high-profile individuals will need to adopt more secure communication methods, potentially moving away from standard calls and SMS for sensitive information. The report also mentions activity from Liminal Panda, another group linked to China-nexus operations, which exploits the IPX network. While a direct link between SilentAir and Liminal Panda is not yet established, the potential connection suggests a broader, coordinated effort in cyber espionage.
Beyond the Headlines
The SilentAir campaign underscores the evolving nature of state-sponsored cyber threats, moving beyond traditional hacking to exploit fundamental vulnerabilities in global telecommunications infrastructure. The use of SS7 and Diameter protocols for interception highlights a long-standing security weakness in mobile networks that has been difficult to fully address. This situation raises critical questions about the responsibility of telecommunications companies to secure their networks against state-level actors and the role of international cooperation in combating such threats. The targeting of high-profile figures also points to the increasing use of cyber espionage for political and strategic advantage, blurring the lines between traditional intelligence gathering and cyber warfare. This trend necessitates a re-evaluation of national cybersecurity strategies and a greater emphasis on securing critical infrastructure against sophisticated, state-backed adversaries.
