A recently uncovered espionage group, identified as SilentAir, has been utilizing compromised infrastructure within Asian telecommunications operators to intercept communications, primarily targeting individuals in Taiwan. The discovery was made by Enea, a Stockholm-based firm specializing in telecom and cybersecurity solutions, which detected the presence of SilentAir across at least six Asian countries. While Enea is confident that SilentAir operates at a state level, its connection to China remains speculative.
Methods of Interception
SilentAir’s strategy involves manipulating the SS7 and Diameter protocols, fundamental to SMS and call routing in mobile networks. These protocols rely on a network known as the IPX, which operates on mutual trust among operators. By infiltrating this network, SilentAir sends false UpdateLocation messages to reroute the target’s communications through their compromised equipment. This tactic has successfully intercepted two-factor authentication codes, hinting at potential attempts to breach further accounts linked to the targets.
The company’s research indicates that interception attempts constituted 18.3% of SilentAir’s activities, a significant increase compared to the 2.1% typically observed from other surveillance entities. High-profile political and governmental figures were among those targeted, with coordinated attacks suggesting a centralized command.
Global Impact and Response
While Taiwan remains the primary focus, SilentAir’s reach extends across Southeast and East Asia, with occasional targets in regions such as East Africa and Europe. Enea discovered these activities by monitoring unusual signaling patterns, revealing that some operators unknowingly facilitated attacks through their networks. Despite efforts to disrupt SilentAir’s operations, the threat persists, as the compromised infrastructure could be leveraged again.
SilentAir’s activities include sending silent SMS messages, primarily targeting Taiwanese subscribers. These messages, invisible to the recipient, serve as a tool for verifying communication redirection. The majority were dispatched at night, potentially as a check on ongoing diversions.
Security Recommendations and Future Outlook
Enea has advised telecommunications operators to enhance their security measures against such sophisticated threats. Recommendations include deploying comprehensive firewalls for GTP protocols and reinforcing signaling security across their networks. Operators are urged to treat the IPX network as untrusted and integrate signaling security with broader IT security frameworks.
The report does not offer guidance for individuals whose communications might be at risk. However, the emphasis is on operators to bolster defenses and prevent similar intrusions in the future. SilentAir’s sophisticated methods and potential state-level backing underscore the need for vigilant and adaptive security strategies in the telecommunications sector.
Looking forward, the industry must remain alert to evolving threats and continually enhance its security protocols to protect sensitive communications from exploitation.
