SilentAir hijacks mobile network nodes in at least six countries to intercept calls and SMS

Enea said SilentAir launches signaling attacks, mostly over SS7 and sometimes Diameter, from network nodes it has hijacked inside mobile operators. The attacks route a target's incoming calls and SMS messages through the compromised node, allowing the actor to harvest subscriber details and intercept communications. SilentAir also sent silent SMS messages, which do not appear on the recipient's handset, possibly to test whether earlier interception attempts succeeded. The group has been monitored since early 2025, with earlier suspicious activity found in later review.

Enea tracks SilentAir with high confidence as a new state-level actor and assesses with low confidence that it is China-nexus, citing interest in Taiwan, absence of Chinese targets and attack timing consistent with a Chinese workday. The hijacked nodes belong to operators in at least six Asian countries. Besides Taiwan, SilentAir targeted a dozen other countries and territories, including East Africa, Central Asia, the Middle East and Europe. High-profile political and government figures were among those targeted. Location tracking was present but made up only a small part of activity.

The report also describes Liminal Panda, a separate group that Enea says is the only known actor actively exploiting IPX, the interconnect network operators use to exchange traffic. From Q1 2026, Enea blocked GTPDoor backdoor attempts at several mobile operator customers, catching several hundred covert attempts to reach command-and-control servers. Potential infections were seen at five to ten operators and could reach several dozen, mainly in Asia, Africa and Latin America. Enea said SilentAir and Liminal Panda could be connected, but the evidence is not strong enough to link them.

The operational significance is that compromise of operator signaling infrastructure puts interception capability inside the network, bypassing endpoint security on phones and exposing calls, SMS and subscriber metadata for selected targets. Because SMS is often used for verification codes, interception can also expose a common second factor. Because mobile signaling is used to route communications across borders, a single hijacked node can affect users far from the operator that owns it. The targeting of Taiwan, political figures and multiple regions shows a surveillance model that relies on telecom interconnects, not malware on devices, to collect intelligence at scale.