A state-level threat actor known as SilentAir has been intercepting phone calls and text messages from inside mobile networks, targeting high-profile individuals in Taiwan and beyond. The group’s activities were uncovered by cybersecurity firm Enea, which tracks the attacks as a new and sophisticated operation.
SilentAir uses compromised network nodes at mobile operators to launch its attacks, primarily over SS7 and occasionally over Diameter. This allows them to route incoming calls and messages through the hijacked node, harvesting sensitive subscriber information in the process. The hackers can also track targets’ locations, but this appears to be a minor aspect of their activity.
One notable tactic employed by SilentAir is sending silent SMS messages, which do not appear on the recipient’s phone, possibly as a check to see if earlier interception attempts were successful. Enea has been monitoring these attacks since early 2025 and believes they may have been active even before that.
SilentAir’s main target appears to be Taiwan, but the group has also set its sights on other countries and territories in Asia, Africa, Europe, and Central Asia. High-profile political and government figures were among those targeted by SilentAir, highlighting the potential for espionage or even sabotage.
Another threat actor mentioned in Enea’s report is Liminal Panda, which was previously linked to China-nexus operations with low confidence. Liminal Panda has been exploiting IPX, a network used by mobile operators to exchange traffic, using a backdoor called GTPDoor. Enea spotted and blocked several hundred attempts to reach command-and-control servers through this vulnerability.
Interestingly, Enea suggests that SilentAir and Liminal Panda may be connected, but the evidence is not strong enough to confirm this link. It’s also worth noting that Liminal Panda appears to be a more established group, with a history of exploiting vulnerabilities in mobile networks.
The implications of these attacks are significant, particularly for individuals and organizations reliant on secure communication channels. Mobile operators and governments will need to take steps to shore up their defenses against such threats. For the general public, this serves as a reminder that even seemingly secure technologies can be vulnerable to sophisticated cyberattacks.
As we navigate an increasingly complex digital landscape, it’s essential to prioritize security measures for mobile devices and networks. This may include using end-to-end encryption, regularly updating software, and being cautious when receiving unsolicited messages or calls.
Source: SecurityWeek — 2026-11-13