A state-level actor known as SilentAir has been intercepting phone calls and text messages by compromising mobile operator infrastructure, primarily targeting subscribers in Taiwan. This activity has been ongoing since early 2025, according to monitoring by Enea.
SilentAir conducts its operations using Signaling System No. 7 (SS7) and Diameter protocols from hijacked equipment located in at least six Asian countries. The group has targeted individuals across a dozen countries, including high-profile political and government figures.
The group has been linked to China-nexus operations with low confidence, due to its focus on Taiwan and operational patterns that align with Chinese time zones. SilentAir's interception activities account for approximately 18.30% of its total operations.
SilentAir also sends silent SMS messages that do not appear on the recipient's phone, primarily targeting users in Taiwan. Additionally, there have been attempts to intercept two-factor authentication codes as part of their activities.
Enea has identified another group, Liminal Panda, which has been active in exploiting mobile operator networks. Liminal Panda has been linked to China-nexus operations and has infected at least five to ten mobile operators.
Enea warns that vulnerabilities in global telecommunications infrastructure remain, allowing for potential future incursions by SilentAir or similar actors.