What's Happening?
A newly identified Chinese advanced persistent threat (APT) group, SilentAir, has been actively exploiting telecommunications infrastructure since early 2025. According to telco security firm ENEA, SilentAir is planting backdoors within telco networks
to execute malicious SS7 and Diameter commands. These commands enable the group to collect device data, track subscriber locations, and intercept calls and SMS traffic. While SilentAir's SS7/Diameter attacks have been detected in six countries, the majority of its targets have been Taiwanese telcos and their subscribers. In some instances, the group has also targeted high-value individuals, such as political figures and government officials. SilentAir is noted for its sophisticated and covert espionage activities, operating with a stable presence in hacked networks through its malware. The group's operations have shown some overlap with another Chinese APT, Liminal Panda, in terms of network presence, though only SilentAir has been observed using SS7 and Diameter for subscriber espionage.
Why It's Important?
The activities of SilentAir highlight a significant and evolving threat to global telecommunications security, with particular implications for national security and individual privacy. The ability of state-sponsored groups to exploit core telco protocols like SS7 and Diameter allows for deep and pervasive surveillance, potentially compromising sensitive communications of government officials, businesses, and citizens. For the U.S., this type of cyber espionage, even if primarily targeting other nations, underscores the vulnerability of interconnected global networks and the potential for similar attacks on its own infrastructure. The targeting of Taiwanese telcos is particularly notable given the geopolitical tensions in the region, suggesting strategic intelligence gathering. The sophisticated nature of SilentAir's operations, including its ability to maintain covert access, indicates a high level of state-backed capability that could be leveraged for broader strategic objectives, including intelligence collection relevant to U.S. interests and allies.
What's Next?
Telecommunications providers globally, including those in the U.S., are likely to increase their focus on securing SS7 and Diameter protocols and enhancing their threat detection capabilities against sophisticated APTs. Cybersecurity firms and government agencies will continue to monitor SilentAir's activities and share intelligence to counter its evolving tactics. International cooperation among cybersecurity experts and law enforcement will be crucial to address the cross-border nature of these threats. Furthermore, the ongoing development of more resilient telco infrastructure and the implementation of advanced security measures will be prioritized to mitigate the risks posed by such state-sponsored espionage groups. The U.S. government and its allies may also consider diplomatic or economic responses to nations found to be sponsoring such cyber activities, particularly if U.S. interests or citizens are directly affected.
Beyond the Headlines
The SilentAir campaign reflects a broader trend of nation-states leveraging cyber capabilities for strategic advantage, moving beyond traditional intelligence gathering to persistent access within critical infrastructure. This 'gray-zone' statecraft blurs the lines between peace and conflict, allowing for continuous psychological warfare and signaling of capabilities without overt military action. The exploitation of fundamental telecommunications protocols like SS7 and Diameter reveals a deep understanding of network architecture and a long-term investment in cyber espionage tools. This raises ethical concerns about the pervasive nature of state surveillance and the erosion of privacy in an increasingly interconnected world. The potential for such access to be held in reserve for wartime sabotage also highlights the dual-use nature of these cyber capabilities, posing a significant challenge to international norms and cybersecurity frameworks.
