A newly uncovered espionage campaign dubbed “SilentAir” is using compromised telecom infrastructure across Asia to intercept SMS-based two-factor authentication (2FA) codes and monitor voice and message traffic, with Taiwan emerging as a primary target. The attack group operates through hijacked equipment inside mobile operators, exploiting vulnerabilities in telecom signalling protocols like SS7 and Diameter.
How the SilentAir Attacks Work
Security researchers at a Stockholm-based telecom and cybersecurity firm traced the origin of the attacks to equipment embedded within operators’ networks in at least six Asian countries. These systems used the SS7 (Signalling System No. 7) and Diameter protocols—standards used globally by mobile networks to route calls, texts, and provide roaming services. SilentAir leveraged compromised access to an international exchange known as IPX to inject forged messages into mobile home networks. Among the techniques used was sending malicious UpdateLocation (or Diameter equivalent) messages, tricking the network into rerouting a target’s calls and SMS to the attackers before they reached the intended recipient.
Scope of the Intrusion and Key Targets
The intercepting of SMS, including 2FA codes, was observed in roughly 18.3% of SilentAir’s detected operations—nearly nine times higher than previously recorded averages for similar surveillance actors. Although there’s no clear proof yet that the attackers actively took over victims’ accounts, the speed and precision of interceptions shortly after traffic rerouting suggest attempts at account compromise.
While most of the victims are government or political figures based in Taiwan, SilentAir has cast a wider net. Signals from other Southeast and East Asian operators, and in rare cases across East Africa, Central Asia, the Middle East, and Europe, indicate broader geographic activity. Silent SMS messages—texts invisible to recipients—were also widely used to check whether traffic rerouting (diversion) was still in effect. These hidden messages often carried bland or spam-like content, possibly as a disguise in case any message status was altered en route.
Who’s Behind SilentAir?
Researchers have strong confidence SilentAir is backed by a state-level actor. While the group hasn’t been definitively tied to any government, low-confidence indicators suggest a Chinese linkage: targeting of Taiwanese users, alignment with China Standard Time working hours, pauses during Chinese public holidays, and consistent 9-to-5 UTC+8 activity. There are possible overlaps with another group known as Liminal Panda, which has been linked to telecom intrusions in the region. At the same time, tools like SCTPE, a Linux-based trojan that interacts with SS7 and Diameter, share behavioral similarities—but so far SilentAir’s operations appear more sophisticated in both operational security and capability.
Detection, Mitigation and Recommendations
SilentAir’s presence was first noticed in early 2025 when unusual signaling traffic between operators raised suspicions. Detailed investigations confirmed that network equipment within certain operators was being used both to send and receive control commands—solid evidence of compromise. While specific names of the compromised operators and individuals targeted have not been disclosed, affected carriers were informed, and according to the researchers, the attack infrastructure has been at least partially disrupted.
To mitigate similar threats in the future, operators are urged to strengthen defenses by deploying firewalls for both GTP-C and GTP-U protocols and configuring them to share intelligence with SS7 and Diameter defenses. Treating international exchanges (IPX) as untrusted, integrating internal signal protocol monitoring, and tying signaling security tightly to overall network and IT security practices are also key recommendations.
SilentAir’s discovery shines a spotlight on an alarming evolution in telecom surveillance—one where attackers penetrate deep into network backbones to intercept 2FA, the very tool most rely on for security. For users in regions with less resilient infrastructure or under malicious surveillance pressure, this is a stark reminder that even multi-factor protections aren’t immune to advanced threats. Moving forward, telecom operators must adopt holistic security architectures, regulators should enforce transparent signaling standards, and individuals should consider using stronger 2FA alternatives wherever possible, such as authentication apps or hardware tokens.
