A newly identified spying group has been hijacking equipment inside mobile phone operators across Asia to intercept the calls and text messages of selected people, with Taiwan as its main target. Telecom and cybersecurity company Enea, based in Stockholm, named the group SilentAir this week after tracking its activity since early 2025.

Enea said it assesses with high confidence that SilentAir is a state-level actor. It linked the activity to China only with low confidence, based on the focus on Taiwan, the absence of Chinese targets, and attack timing that followed a working day in the UTC+8 time zone, starting at 9 a.m., almost stopping at weekends and pausing around Chinese holidays.

How the interception worked

Mobile operators exchange signalling messages using the SS7 and Diameter protocols to route calls and texts and to make roaming work. That traffic crosses a shared network called the IPX, which runs on a high level of trust between operators. SilentAir sent its attacks into the IPX from equipment it had taken over at operators in at least six Asian countries.

For interception, SilentAir sent the target's home network an UpdateLocation message, or its Diameter equivalent. The message claimed that the hacked equipment was now serving the target's phone. If the home network accepted it, calls and texts for that person would be diverted to the attackers. For some targets, Enea observed two-factor authentication (2FA) codes being intercepted immediately after the diversion took effect, which points to an attempt to break into other accounts registered to those people. The report gives no similar evidence for voice calls, and it does not say whether any account was taken over.

Interception made up 18.3% of the attacks Enea saw from SilentAir. For a typical surveillance company, the kind of firm behind most signalling attacks, the share was 2.1% in the company's earlier research. Some targets were political and government VIPs in their own countries. In rare cases, SilentAir equipment in several countries worked together against such targets, which Enea said points to a single controller.

Bursts of activity and silent texts

The attacks came in bursts, from one or a few subscribers to several thousand over a month, with gaps of up to several months or longer between bursts. Outside Taiwan, targets were mostly in other Southeast and East Asian networks, and at times in East Africa, Central Asia, the Middle East and Europe. People using the hacked operators' own networks may also have been targeted, but Enea said it could not see that traffic.

SilentAir also sent silent SMS messages on a very large scale, mainly to subscribers in Taiwan. These are texts that the phone does not display or alert on. During the day, most silent SMS went to subscribers on other networks, and one of their main uses appears to have been checking whether a diversion had worked: if the test text reached the hacked equipment instead of the phone, the attackers knew they were getting that person's texts. Most silent SMS went out at night, and most of those went to people in Taiwan. Enea said the purpose of those messages is not confirmed, but they may have been a bulk check that earlier diversions were still in place, since phones are least likely to re-register to their real location at night. The silent texts carried spam-like motivational or promotional lines, often in English, which Enea believes was a disguise: if an operator along the way stripped a message's silent setting, the recipient would see it as spam and ignore it.

What happens next

Enea has told the operators where it found SilentAir sources. It said SilentAir has been disrupted for now but could return, and the report does not say whether those operators have cleaned up the hacked equipment. The report does not name the countries, the operators or any of the targets, and in some countries SilentAir attacks came from more than one operator.

Enea also considered a link to Liminal Panda, a group behind earlier telecom intrusions, but called the link possible and unconfirmed. In several hacked operators, SilentAir attacks happened during a known Liminal Panda infection, while at other times the two showed no sign of working together.

The company said any attacker could reuse these techniques, and it told operators to deploy GTP-C and GTP-U firewalls and configure them to share information with their SS7 and Diameter firewalls, to go beyond the industry's basic recommendations for signalling security, to treat the whole IPX as untrusted, to add detection for signalling protocols inside their own networks, and to connect signalling security with the rest of their IT security. The report does not advise people whose calls and texts may be targeted. Full details are in SecurityWeek's report on SilentAir.