SilentAir, a newly identified spying group, has been hijacking Asian telecom networks to intercept SMS two-factor authentication (2FA) codes and spy on users, primarily in Taiwan. Enea, a telecom and cybersecurity software company, has assessed SilentAir as a state-level actor, though links to China are made with low confidence.
The group's attacks were executed using hacked equipment within Asian mobile operators. SilentAir intercepted calls and texts of selected individuals, with their interception activities comprising 18.3% of observed attacks, significantly higher than the typical 2.1% for surveillance companies.
SilentAir's operations were conducted in bursts, affecting from one to several thousand subscribers over a month. The group sent silent SMS messages on a large scale to Taiwanese subscribers to verify if their diversions were successful.
The attacks have been tracked since early 2025, with unusual activity noted over SS7 and Diameter protocols. SilentAir's attacks were confirmed to originate from equipment inside the networks of several operators.
Enea could not analyze the malware believed to be used by SilentAir. However, the group's behavior partly matches that of SCTPE, a Linux trojan designed for SS7 and Diameter traffic manipulation.
SilentAir's tracking and interception activities followed a working day in UTC+8, aligning with China Standard Time.