Enea: SilentAir hijacked operator signaling gear to divert SMS 2FA codes in Asia

Compromised gear inside six operators

Enea, a Stockholm-based telecom security firm, has disclosed a campaign by a group it names SilentAir, which took over signaling equipment inside mobile operators in at least six Asian countries and used that foothold to divert the calls and texts of chosen subscribers, most of them in Taiwan. According to a dev.to report on Enea's findings, some diversions led directly to the interception of SMS two-factor authentication codes, and the target list included political and government figures.

Enea assesses with high confidence that SilentAir is a state-level actor, though it links the group to China only with low confidence. The company says it has told the affected operators where the SilentAir sources sit and that the group is disrupted for now, but the report does not confirm that the hacked equipment has been cleaned up, and Enea warns the group could return.

Forged location updates divert traffic

Operators exchange SS7 and Diameter signaling messages to route calls and texts and to support roaming, and that traffic crosses the IPX, an interconnect network built on a high level of trust between carriers. SilentAir did not spoof its way into this system. Per the dev.to summary of Enea's research, it attacked from equipment inside real operators it had already compromised, so its messages carried the trust that belongs to legitimate carrier gear.

To intercept a target, the group sent the victim's home network an UpdateLocation message, or the Diameter equivalent, claiming that the compromised equipment now served the target's phone. Once the home network accepted it, traffic for that subscriber went to the attackers, with no sign on the victim's device that anything was wrong. Enea observed 2FA codes intercepted immediately after some diversions took effect, suggesting attempts to reach other accounts tied to those numbers. Interception made up 18.3% of the SilentAir attacks Enea observed, versus 2.1% for a typical commercial surveillance vendor in Enea's earlier research — nearly nine times higher. The report offers no similar evidence for voice calls and confirms no account takeover.

Silent SMS as a diversion check

SilentAir also sent silent SMS — messages a phone receives without displaying or alerting — at very large scale, mostly to subscribers in Taiwan. Enea says a main daytime use appears to have been verifying that diversions held: if a test text arrived at the attackers' equipment instead of the handset, they knew they were receiving that person's messages. Night traffic also went mostly to Taiwan; its purpose is unconfirmed, but one possibility Enea raises is a bulk re-check of diversions, since phones re-register least often overnight. The texts carried spam-like motivational and promotional lines, often in English, which Enea believes served as cover in case an operator along the route stripped the silent flag.

Targets, tempo and attribution

Activity came in bursts covering anywhere from one subscriber to several thousand over a month, separated by gaps of up to several months or longer. Outside Taiwan, most targets were on Southeast and East Asian networks, with some in East Africa, Central Asia, the Middle East and Europe. Subscribers on the compromised operators' own networks may also have been targeted, but Enea could not see that traffic. In rare cases, equipment in several countries worked against a single target, which Enea reads as a single controller.

Enea began tracking unusual SS7 and Diameter attacks from Asian operators in early 2025, later finding suspicious activity reaching further back. Odd handling of follow-up messages left two explanations — spoofed signaling addresses or compromised internal equipment — and the second was confirmed when Enea watched equipment inside one operator both send and receive attack commands. After containment, Enea recovered traces of unauthorized access but could not analyze the malware it believes was used.

The low-confidence China link rests on the focus on Taiwan, the absence of attacks on Chinese networks or subscribers, and activity following a UTC+8 working day that paused on weekends and around Chinese holidays. A connection to Liminal Panda, a group behind earlier telecom intrusions, is possible but unconfirmed. SilentAir's behavior also partly matches SCTPE, a little-known Linux kernel trojan for SS7 and Diameter traffic that a Singapore IMDA advisory describes under the name SIGweaver and that CrowdStrike linked to Liminal Panda with moderate confidence after identifying it on January 21. Enea notes one difference: the known SCTPE program cannot answer messages it did not send, which SilentAir did.

Why it matters

The campaign exposes the weak point of signaling defenses that vet the sender: when legitimate operator equipment is compromised, its traffic inherits the IPX's trust, and source checks pass. For victims, every SMS one-time code flowed to the attackers for as long as a diversion lasted, and device-level security offered no protection because the attack lived inside the carrier network. The 18.3% interception share points to collection of specific individuals' communications rather than mass location tracking. With cleanup unconfirmed and the malware unanalyzed, the report leaves open whether the capability is truly gone — and it is a fresh argument against relying on SMS-based 2FA for high-value accounts.