State-Sponsored SilentAir Actor Targets Taiwanese Communications via Compromised Asian Telcos
A sophisticated state-level threat actor, dubbed SilentAir, has been leveraging compromised mobile operators across Asia to intercept calls and text messages, with a primary focus on targets in Taiwan.
A newly identified state-level threat actor, operating under the moniker SilentAir, has been actively engaged in intercepting telecommunications traffic, primarily targeting subscribers in Taiwan. Cybersecurity firm Enea, which has been monitoring the actor since early 2025, detailed these operations in a November 11 research report. The actor employed Signaling System No. 7 (SS7) and Diameter attacks, launching them from hijacked infrastructure within mobile operators located in at least six Asian countries. These attacks impacted targets across a dozen additional countries and territories, demonstrating a broad reach.
Enea's analysis indicates that SilentAir's operations were conducted in distinct waves, ranging from a few thousand subscribers to several thousand within a single month, interspersed with quiet periods lasting several months. Notably, interception constituted a significant portion of SilentAir's observed activity at 18.30%, a rate considerably higher than the 2.07% seen from surveillance companies typically involved in signaling attacks. This suggests a focused and persistent effort on eavesdropping.
Further investigation into SilentAir's tactics revealed a concerning pattern: for some targeted individuals, two-factor authentication (2FA) codes were intercepted shortly after call or text interception began. Enea suggests this indicates a potential secondary objective of compromising other online accounts belonging to the victims. The majority of SilentAir's other activities involved silent SMS messages, which are texts sent without appearing on the recipient's phone, predominantly directed at Taiwanese users, often around midnight local time.
While Enea expressed low confidence in a direct link to China-nexus operations, several indicators point towards such a connection. These include the specific focus on Taiwan, the absence of Chinese targets, the actor's working hours aligning with China's time zone, and periods of inactivity coinciding with Chinese holidays. The targeting of political and government VIPs further underscores the potential state-sponsored nature of these attacks.
In parallel, Enea's research also highlighted the activities of Liminal Panda, another threat actor that has been observed attacking mobile operators. Enea's firewalls detected and blocked Liminal Panda's GTPDoor malware and other related activities at multiple customer operators since early 2026, thwarting hundreds of command-and-control (C2) communication attempts. GTPDoor is a Unix backdoor designed to conceal its C2 traffic within the GPRS Tunneling Protocol (GTP), which is commonly used for mobile data roaming.
Enea estimates that at least five to ten mobile operators have been infected by Liminal Panda, either directly or through strong indications, with the actual number potentially reaching several dozen, predominantly in Asia, Africa, and Latin America. The firm also identified a new variant of GTPDoor that exploits GTP-U, the part of the protocol responsible for carrying user data. This variant is considered more stealthy due to the higher volume and less scrutinized nature of GTP-U traffic, and its compatibility with 5G networks.
CrowdStrike had previously linked Liminal Panda to China-nexus operations in November 2024, also with low confidence. Enea stated that it assisted its customers in removing Liminal Panda from their networks and alerted operators hosting the infrastructure used by SilentAir. While both groups have been disrupted for the time being, Enea cautioned that the underlying conditions enabling such attacks persist, leaving the door open for their return or the emergence of new threats.