SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks
SilentAir hackers exploit mobile network nodes to intercept calls and SMS, targeting Taiwan.
Enea has identified a new state-level threat actor, dubbed SilentAir, that compromises mobile operator infrastructure to intercept calls and SMS messages, primarily targeting subscribers in Taiwan. The group uses hijacked network nodes, often over SS7 or Diameter protocols, to route and harvest subscriber data. Enea also details the activity of Liminal Panda, which exploits the IPX interconnect network with its GTPDoor backdoor, noting potential connections between the two actors.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CrowdStrike?
Get an email when a new story names CrowdStrike, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonSilentAir and Liminal Panda demonstrate that state-level threat actors are actively compromising mobile operator infrastructure by exploiting legacy signaling protocols — SS7, Diameter, and GTP — that were designed for trust-based interconnect environments, not adversarial ones. By hijacking network nodes and leveraging the IPX interconnect network, attackers can silently intercept calls and SMS messages without touching end-user devices, making detection extremely difficult. These protocols were built decades ago with the assumption that only legitimate carriers would participate, leaving them fundamentally vulnerable to abuse by any actor who can reach the network layer. The scale of harm is significant: targeted subscribers have no visibility into the interception, and sensitive communications including authentication codes transmitted via SMS are exposed. This incident underscores why telecom infrastructure must be treated as critical national security infrastructure with rigorous access controls and monitoring.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GTPDoor