[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5xUq3HEWe4MSQkayXm9tSHvIa_y12IEOxM1UlKJ1nfs":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"8b24353b-4898-4d44-8cfd-070a5f4916c7","SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks","silentair-hackers-intercept-calls-sms-from-inside-mobile-networks-76848e","Enea says SilentAir hijacked mobile network nodes to intercept calls and messages, with Taiwanese subscribers the primary targets. The post SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks appeared first on SecurityWeek.","Enea has identified a new state-level threat actor, dubbed SilentAir, that compromises mobile operator infrastructure to intercept calls and SMS messages, primarily targeting subscribers in Taiwan. The group uses hijacked network nodes, often over SS7 or Diameter protocols, to route and harvest subscriber data. Enea also details the activity of Liminal Panda, which exploits the IPX interconnect network with its GTPDoor backdoor, noting potential connections between the two actors.","SilentAir hackers exploit mobile network nodes to intercept calls and SMS, targeting Taiwan.","https:\u002F\u002Fwww.securityweek.com\u002Fsilentair-hackers-intercept-calls-sms-from-inside-mobile-networks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F12\u002Ftelecoms-communications.jpeg","2026-11-13T12:20:28+00:00","2026-11-13T13:00:03.99417+00:00",8,[17,20,22,25,27,30],{"name":18,"type":19},"SilentAir","threat_actor",{"name":21,"type":19},"Liminal Panda",{"name":23,"type":24},"Enea","vendor",{"name":26,"type":24},"CrowdStrike",{"name":28,"type":29},"SS7","technology",{"name":31,"type":29},"Diameter","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":49,"value":57,"context":58},"GTPDoor","Backdoor used by Liminal Panda",[26,23],{"controls":61,"vendors":147},[62,90,119],{"slug":63,"name":64,"problem":65,"products":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":84,"vendor_name":26,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":91,"name":92,"problem":93,"products":94},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":54,"name":120,"problem":121,"products":122},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":158},"state-actors-exploit-telecom-protocols-to-intercept-calls-and-sms-at-network-level","State Actors Exploit Telecom Protocols to Intercept Calls and SMS at Network Level","SilentAir and Liminal Panda demonstrate that state-level threat actors are actively compromising mobile operator infrastructure by exploiting legacy signaling protocols — SS7, Diameter, and GTP — that were designed for trust-based interconnect environments, not adversarial ones. By hijacking network nodes and leveraging the IPX interconnect network, attackers can silently intercept calls and SMS messages without touching end-user devices, making detection extremely difficult. These protocols were built decades ago with the assumption that only legitimate carriers would participate, leaving them fundamentally vulnerable to abuse by any actor who can reach the network layer. The scale of harm is significant: targeted subscribers have no visibility into the interception, and sensitive communications including authentication codes transmitted via SMS are exposed. This incident underscores why telecom infrastructure must be treated as critical national security infrastructure with rigorous access controls and monitoring.",[153,154,155,156,157],"MITRE ATT&CK T1557: Adversary-in-the-Middle","NIST SP 800-53 SC-8: Transmission Confidentiality and Integrity","CIS Control 12: Network Infrastructure Management (v8)","NIS2 Article 21(2)(i)","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events",{"NIS2 Article 21(2)(i)":159,"MITRE ATT&CK T1557: Adversary-in-the-Middle":160,"CIS Control 12: Network Infrastructure Management (v8)":161,"NIST SP 800-53 SC-8: Transmission Confidentiality and Integrity":162,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":163},"This point covers access control and asset management for critical infrastructure; enforcing strict access controls over who can send signaling commands through carrier interconnect networks is the core gap SilentAir exploited.","SilentAir exploits SS7 and Diameter protocol trust to position itself between subscriber communications and legitimate network nodes, intercepting calls and SMS in transit.","This control requires secure management and monitoring of network infrastructure; hardening and monitoring of SS7\u002FDiameter interconnect nodes would have constrained the attackers' ability to hijack network signaling paths.","This control requires protecting the confidentiality and integrity of transmitted information; the absence of such protections on SS7\u002FDiameter\u002FGTP signaling channels is precisely what SilentAir exploits.","Continuous monitoring of SS7, Diameter, and GTP traffic for anomalous signaling patterns would be the primary technical means to detect SilentAir's interception activity before large-scale data harvesting occurs."]