Overview
A newly identified cyber-espionage group known as SilentAir has compromised telecommunications infrastructure across at least six Asian countries to intercept calls and SMS messages, with many of the targeted users located in Taiwan. Telecom security company Enea assessed with high confidence that SilentAir is a state-level actor, although its possible connection to China remains low-confidence. The attacks demonstrate how compromised telecom infrastructure can be used to bypass traditional security controls and intercept sensitive communications.
How the Attack Works
SilentAir abuses trusted SS7 and Diameter signalling protocols used between mobile operators. After compromising equipment inside telecom networks, attackers send signalling messages that falsely indicate a target’s mobile device has moved to attacker-controlled equipment. If accepted, calls and SMS messages can be redirected to the attacker, allowing them to intercept communications without compromising the victim’s phone.
2FA Interception
The most concerning activity involves the interception of SMS-based two-factor authentication codes. Enea observed 2FA messages being intercepted immediately after some targets were redirected, indicating that SilentAir may have been attempting to gain access to other accounts belonging to targeted individuals. The research does not confirm that account takeovers occurred, but the capability significantly reduces the protection provided by SMS-based MFA.
Why It Matters
SilentAir’s activity highlights a major weakness in the mobile ecosystem: trust between telecommunications networks can become an attack path. Enea observed interception activity representing 18.3% of SilentAir’s attacks, considerably higher than the 2.1% seen in its previous research of typical signalling surveillance activity. Targets included political and government figures, while large-scale silent SMS activity was primarily directed at subscribers in Taiwan.
What Telecom Operators Should Do
Operators should treat the IPX and inter-operator signalling environment as untrusted, rather than relying on inherent trust between networks. SS7, Diameter, GTP-C and GTP-U traffic should be monitored and protected using signalling and GTP firewalls, with security controls sharing intelligence across these protocols. Operators should also monitor their own network equipment for compromise, restrict unnecessary signalling capabilities and integrate telecom security monitoring with their wider SOC and incident-response processes.
Expert in the Cloud Insight
SMS-based MFA is only as strong as the telecommunications infrastructure carrying the message. Organisations protecting privileged or high-value accounts should increasingly favour phishing-resistant authentication such as FIDO2/passkeys or hardware-backed authentication rather than relying solely on SMS codes. At the telecom level, the SilentAir campaign also reinforces an important architectural principle: trusted infrastructure should never automatically be treated as trusted traffic.
Expert in the Cloud – The Future Is Now.
Leave a Reply