Enea identifies SilentAir as state-level spying group inside Asian mobile networks

Enea has tracked SilentAir since early 2025 and assessed the group as a state-level spying operation with high confidence, saying it intercepted calls and text messages through compromised equipment inside Asian mobile operators, centered on Taiwan, with attack sources showing up in operator networks in at least six Asian countries.

Hijacked operator equipment let SilentAir launch attacks over SS7 and Diameter, sending messages such as UpdateLocation to redirect targets’ calls and texts, Enea said. SS7 and Diameter are signaling protocols that carry calls and data between mobile networks. The group targeted political and government VIPs, and such interception accounted for 18.3 percent of SilentAir activity. In some cases, attackers captured two-factor authentication codes right after the diversion began, showing an intent to compromise other accounts.

SilentAir sent silent text messages in high numbers mainly to Taiwan subscribers, including texts at night of unconfirmed purpose. Daytime silent texts mostly went to subscribers on foreign networks, including ones in Southeast Asia, apparently to check if a diversion worked. Most of the silent SMS moved at night, and most night messages went to people in Taiwan; Enea said their purpose remains unconfirmed but may be a bulk check that earlier diversions stayed in place. The messages carried spam-like motivational or promotional language, often in English, working as a cover, so recipients would dismiss them as spam and miss them if carriers lifted the silent flag.

Enea tied SilentAir to China with low confidence, pointing to its Taiwan focus, the lack of Chinese targets, and activity timed to a China Standard Time workday. The company said activity ran on a UTC+8 workday, starting at 9 a.m., almost stopping on weekends, and easing around Chinese holidays.

A link between SilentAir and Liminal Panda might exist but is unproven, and the company does not group them together, Enea said. Hits by SilentAir coincided with known Liminal Panda infections at several hacked operators, although the two showed no sign of cooperating at other times even while aiming at operators in the same Asian region. The company assessed SilentAir’s tradecraft as substantially stronger than Liminal Panda’s.

Enea said SilentAir’s methods resemble SCTPE, a little-known Linux kernel trojan that sends and receives SS7 and Diameter traffic, but SilentAir answered messages it did not send, something SCTPE cannot do. The firm also could not inspect the malicious code it links to SilentAir. Singapore’s IMDA gave the name SIGweaver to the tool in an official advisory and said the vendor ties it to Liminal Panda at moderate confidence; CrowdStrike identified it on January 21. It also blamed Liminal Panda for China-linked operations with low confidence in November 2024.

Enea found and stopped Liminal Panda GTPDoor activity at multiple customer operators beginning in the first quarter of 2026, and also blocked Liminal Panda activity starting in early 2026. The company puts total Liminal Panda infections at potentially several dozen, with probable cases centered in Asia, Africa and Latin America, and it logged several hundred hidden attempts by Liminal Panda to reach its command-and-control servers. GTPDoor was first recorded on February 27, 2024, and hides commands inside GTP-C, the protocol that sets up mobile data links between networks; a newer version conceals commands in GTP-U user data traffic, which is harder to inspect. Enea said the newer version probably serves mainly as a fallback, and the GTP-U variant also functions in 5G while receiving less attention than control traffic.

Liminal Panda infections or strong indicators appeared in no fewer than five to ten operators, Enea observed. The company said Liminal Panda is the only actor seen actively using the IPX interconnect network. Signaling traffic from mobile operators crosses the IPX, a shared network constructed on strong mutual trust between carriers.

Attack waves hit anywhere from a few subscribers to several thousand each month, with gaps of as long as several months, Enea said. Sometimes, compromised equipment in different countries worked on the same targets, pointing to one controller. In the company’s prior work, ordinary surveillance firms responsible for most signaling attacks made up 2.1 percent of that activity.

SilentAir is currently disrupted but could return, Enea said, and both groups are set back for now while warning that conditions still let them or other actors come back. The company has not said whether the operators removed the hacked equipment. It helped customers remove Liminal Panda and told operators hosting SilentAir sources about them, while passing SilentAir source locations to the affected operators.

The company urges operators to install GTP-C and GTP-U firewalls and set them to exchange data with SS7 and Diameter firewalls. The company also says operators should consider the whole IPX untrusted, watch for signaling protocol use inside their own networks, connect signaling security to wider IT security, and go beyond the sector’s baseline guidance on signaling protection. Its report does not name the countries, operators or targets, and notes that SilentAir attacks came from multiple operators in some countries. The report gives no advice to people whose calls and texts could be monitored.