A newly identified state-level actor has used compromised mobile operators in Asia to intercept calls and texts, mainly targeting subscribers in Taiwan. Enea has watched it since early 2025.
Enea, a firm providing software for telecommunications and cybersecurity, named the actor SilentAir in its November 11 research, which also covers Liminal Panda, a group that has attacked mobile operators.
The company said it saw a possible but unproven connection between the two groups.
SilentAir Targets Taiwanese Subscribers
Enea is highly confident that SilentAir operated at state level. The actor launched Signaling System No. 7 (SS7) and Diameter attacks from hijacked equipment in operators across at least six Asian countries, hitting targets in a dozen more countries and territories.
The attacks came in waves, from a handful of subscribers to several thousand in a month, with quiet spells of months in between. Interception accounted for 18.30% of SilentAir's activity, against 2.07% for the surveillance companies behind most signaling attacks.
For some targets, two-factor authentication (2FA) codes arrived moments after interception began, which Enea said showed an aim of breaking into their other accounts. Most of its other activity was silent SMS, texts that never show on the phone, sent largely to Taiwanese users around midnight.
Enea linked SilentAir to China-nexus operations with low confidence, citing the Taiwan focus, the lack of Chinese targets, working hours matching China's time zone and lulls over Chinese holidays. Some targets were political and government VIPs.
Read more on telecom espionage: Singapore Takes Down Chinese Hackers Targeting Telco Networks
Liminal Panda Expands GTPDoor
Enea said its firewalls spotted and blocked GTPDoor and other Liminal Panda activity at several customer operators from early 2026, detecting several hundred attempted command-and-control (C2) exchanges.
GTPDoor, a Unix backdoor, hides its C2 traffic in the GPRS Tunneling Protocol (GTP), which carries roaming data.
Enea said it had seen at least five to 10 operators infected by Liminal Panda, directly or through strong indications, and believed the true figure might be several dozen, concentrated in Asia, Africa and Latin America.
It also found a new GTPDoor version that rode on GTP-U, the part of the protocol carrying user data. That traffic is far heavier and, according to Enea, less closely watched, and unlike the control side it carries over into 5G. Enea believed the new version mostly served as a fallback.
CrowdStrike linked Liminal Panda to China-nexus operations in November 2024, also with low confidence.
Enea said it helped customers clear out Liminal Panda and alerted operators hosting SilentAir sources. It said both groups had been set back for now, but warned the conditions remained for them, or others, to return.