Telecom software and cybersecurity firm Enea has uncovered a new cyber threat actor named SilentAir, which is infiltrating mobile operator infrastructures to intercept phone calls and text messages. Taiwan has emerged as the primary target of these sophisticated operations.
State-Level Threat and Potential China Nexus
Enea has identified SilentAir as a new state-level actor. While there is low confidence in the exact origins of the group, the company notes several indicators suggesting possible links to China. These include the focus on Taiwan, the lack of Chinese targets, and the timing of attacks aligning with Chinese work hours.
SilentAir employs signaling attacks primarily via the SS7 protocol, with occasional use of the Diameter protocol. These attacks reroute calls and SMS through compromised nodes within mobile networks, allowing the hackers to gather subscriber information.
Scope and Techniques of SilentAir Attacks
In addition to intercepting communications, SilentAir can track user locations, although this is a minor part of their operations. The group sends silent SMS messages, which do not appear on the target’s phone, possibly to verify the success of their interception efforts.
Since early 2025, Enea has been monitoring these attacks, uncovering suspicious activities dating back further. The hijacked network nodes are found in operators across at least six Asian countries. Besides Taiwan, SilentAir has targeted numerous other nations, including regions in East Africa, Central Asia, the Middle East, and Europe, focusing on high-profile political and governmental figures.
Connections to Other Threat Groups
The report also highlights activities from Liminal Panda, a group linked to China-nexus operations by CrowdStrike. Liminal Panda is noted for exploiting the IPX network—a critical infrastructure for mobile traffic exchange.
In the first quarter of 2026, Enea detected and blocked several attempts by Liminal Panda to deploy the GTPDoor backdoor across its mobile operator clients. The company estimates potential infections at five to ten operators, with a broader impact possible across Asia, Africa, and Latin America.
While there is speculation about a connection between SilentAir and Liminal Panda, Enea acknowledges that current evidence is insufficient to confirm a direct link.
Related: China-Linked Hackers Exploit PHP2Shell to Root Firewalls
Related: China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Related: China’s Top Cybersecurity Firms Hit by Mounting Military Procurement Bans
