Enea, a Stockholm-based telecommunications and cybersecurity software company, has identified a previously unknown cyber espionage group that it tracks as SilentAir. According to the company, the group compromised equipment inside mobile network operators in at least six Asian countries and used the infrastructure to intercept calls and text messages belonging to selected subscribers, with Taiwan identified as its primary target. Enea assessed with high confidence that SilentAir represents a state-level threat actor, while its possible connection to China-linked cyber operations was assessed with low confidence. The company said it had informed the affected mobile operators about suspicious network sources and believed the activity had been disrupted for the time being, although it warned that the group could return. The findings are detailed in Enea’s technical investigation, which examines attacks against the global mobile interconnection infrastructure. Enea identified suspicious network elements associated with SilentAir in at least six Asian countries and observed attacks targeting subscribers in more than a dozen additional countries and territories. Taiwan accounted for the primary focus, while other targets were located across Southeast and East Asia, as well as parts of East Africa, Central Asia, the Middle East and Europe. The report does not identify the affected countries, mobile operators or individual subscribers.
The attacks exploited the trust relationships between mobile operators through the IPX, a shared interconnection environment that supports the exchange of signalling traffic for roaming, calls and messaging. Mobile networks use protocols including Signalling System 7 (SS7) and Diameter to manage these services. Enea found that SilentAir used compromised network equipment to introduce malicious signalling messages into this environment. One technique involved sending an UpdateLocation message, or its Diameter equivalent, to a subscriber’s home network while falsely indicating that the person’s phone was being served by the compromised equipment. If accepted, the update could redirect incoming calls and text messages through the attacker-controlled network node. Enea observed successful interception activity, including two-factor authentication (2FA) codes arriving at compromised equipment immediately after some diversions took effect. This suggested that the group may have attempted to access other accounts associated with targeted individuals, although the report does not confirm that any accounts were successfully taken over. Interception represented 18.3% of the attacks attributed to SilentAir in Enea’s observations, compared with 2.07% for typical surveillance-company activity in the company’s earlier research. Some targets were political and government figures in their respective countries. In exceptional cases, equipment located in multiple countries coordinated attacks against high-value targets, which Enea said indicated the presence of a shared controller. The activity appeared in bursts, ranging from attacks against a small number of subscribers to campaigns involving several thousand people over a month, with periods of inactivity lasting several months.
Another significant feature of the campaign was the large-scale use of silent SMS messages, which reach mobile devices without displaying a notification or appearing in the normal messaging interface. Enea observed that many of these messages were directed at Taiwanese subscribers, particularly during nighttime hours. During the day, silent SMS activity more frequently involved subscribers on other networks and appeared to help determine whether previously attempted message diversions had succeeded. The purpose of the larger nighttime campaigns was not confirmed, although Enea suggested they might have been used to check whether earlier diversions remained active. Some messages contained generic motivational or promotional phrases, often written in English. Enea believes this wording may have served as a disguise in cases where an intermediate operator removed the silent-message setting and caused the text to appear normally on a recipient’s device. The company began tracking unusual signalling activity from certain Asian mobile operators in early 2025, with later analysis identifying suspicious activity dating back further. Investigators initially considered whether the traffic was being generated through spoofed network addresses, but subsequently observed equipment inside an operator both sending and receiving attack commands. This provided evidence that network equipment itself had been compromised. Enea said detecting the activity was challenging because the operators behind it demonstrated a strong understanding of mobile network architecture and existing signalling security measures. Although investigators recovered traces of unauthorised access after containment, they were unable to analyse the suspected SilentAir malware. The company also examined possible similarities with Liminal Panda, a previously identified telecom-focused threat group. Some activity overlapped in timing and affected operators, while SilentAir’s behaviour partly resembled a Linux kernel-level tool known as SCTPE, which Singapore’s Infocomm Media Development Authority (IMDA) has referred to as SIGweaver in its government advisory. However, Enea found that SilentAir handled certain signalling responses in ways that the known SCTPE sample could not explain. The company therefore described a connection with Liminal Panda as possible but unconfirmed and did not formally associate the two groups.
Enea also reported separate Liminal Panda activity involving GTPDoor, a backdoor used to communicate through mobile network protocols. Since the first quarter of 2026, the company said its GTP firewall had detected and blocked hundreds of attempted covert communications across several customer networks. Its investigation identified direct evidence or strong indications of infections affecting between five and ten mobile operators, with the possibility of a wider footprint. Enea also found evidence of a newer GTPDoor version that uses GTP-U, the part of the GPRS Tunnelling Protocol responsible for carrying user data, rather than relying only on GTP-C, which manages data connections. The company said GTP-U traffic is more difficult to inspect because of its volume and layered structure. Although this activity relates to Liminal Panda, Enea discussed it separately from SilentAir and did not establish that the two operations were controlled by the same group. For mobile operators, Enea recommends deploying security systems that monitor both GTP-C and GTP-U traffic alongside existing SS7 and Diameter protections. It also advises treating the entire IPX environment as untrusted, extending detection capabilities to signalling activity within internal mobile networks and integrating telecommunications security monitoring with broader IT security operations. The company stressed that isolated protections may not provide sufficient visibility into attacks that move across different interconnection protocols. Enea said it had notified operators where it identified suspicious SilentAir sources and would continue monitoring activity across mobile networks. Its findings highlight the security risks associated with trusted interconnections between telecommunications providers, while leaving the identities of affected operators and subscribers undisclosed.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
