SilentAir Hackers Hijack Asian Mobile Networks to Steal Calls, Texts and 2FA Codes
- Who should care: Mobile operators, banks, fintechs, and any company that still sends login codes by text message, the exact channel SilentAir abuses.
- What could go wrong: A state-level crew working from inside a carrier can quietly reroute your texts and read the 2FA code meant for you.
- Do this: Find every account that falls back to SMS codes and move the risky ones to passkeys or hardware keys.
- Worth remembering: Phone networks trust each other by default. This crew turned that trust into a wiretap.
A newly named spy crew called SilentAir has been hijacking equipment inside Asian mobile operators to reroute calls and texts, mostly from Taiwanese subscribers. Some of the diverted messages carried 2FA codes, a sign someone wanted into other accounts.
What Happened?
Stockholm telecom security firm Enea published its findings this week, as The Hacker News and SecurityWeek reported. The firm has tracked the group since early 2025. The crew launched signaling attacks, mostly over SS7 and sometimes over Diameter, from hacked nodes at operators in at least six Asian countries.
A forged UpdateLocation message told a victim’s home network that the hacked node was now serving the phone. As a result, incoming calls and texts went to the attackers. Targets spanned about a dozen countries and territories and included political and government VIPs.
The Silent SMS Twist
Interception made up 18.3% of the group’s activity. By comparison, a typical surveillance vendor sits at about 2%. Another 74.27% was silent SMS, texts that never appear on the handset. During the day, the pings probably checked whether a diversion had worked. The night bursts toward Taiwan peaked near midnight, and some copies that leaked through carried cheery English spam as cover.
Who’s Behind It?
Enea rates SilentAir a state-level actor with high confidence. It links the group to China with low confidence, pointing to a UTC+8 workday, pauses over Chinese holidays, and zero Chinese targets. The crew’s activity sometimes overlapped with Liminal Panda, the group behind GTPDoor and SIGweaver, but Enea doesn’t link the two. For example, the new crew answered messages it never sent, and the known SIGweaver trojan can’t do that.
What’s the Impact?
Anyone whose bank, email or cloud login falls back to SMS is exposed, even if their own carrier was never breached. The attack travels over the trusted roaming exchange (IPX), so the home network sees what looks like a routine location update. Meanwhile, nothing shows up on the victim’s phone.
How to Avoid This
- Swap SMS codes for passkeys or FIDO2 keys, starting with admins, executives and finance staff
- Operators should run SS7, Diameter and GTP firewalls that share alerts with each other
- Treat all IPX traffic as untrusted, DNS and ICMP included
- Flag UpdateLocation requests from networks a subscriber has never visited
- Send signaling alerts to the same analysts who handle IT alerts
SilentAir Indicators of Compromise
The group left few file traces, and Enea couldn’t analyze its binary. Instead, most indicators are behavioral. The visual below lists the behavioral signals plus hashes for related Liminal Panda tools. Use them as hunting leads, not proof.
Find Your SMS Weak Spots Before SilentAir Does
Most companies can’t say how many of their logins still depend on a text message. Secure.com’s AI teammates attack your defenses first, harden what they find, and prove the fix, under rules your team sets.
- Maps every identity and app that still accepts SMS as a second factor
- Tests MFA and account recovery flows the way an attacker would
- Ranks high-value accounts (admins, finance, executives) for the passkey rollout
- Triages odd login and impossible travel alerts so analysts skip the grunt work
- Logs every hardening step so you can show it to auditors and leadership
