SilentAir hijacks Asian telecom nodes to intercept SMS 2FA codes

Telecom security vendor Enea has detailed a mobile-network intrusion set it calls SilentAir, which hijacks equipment inside mobile operators to divert targets' calls and text messages and harvest incoming SMS two-factor codes. Enea assesses with high confidence that SilentAir is a state-level actor and — with low confidence — that it aligns with China-nexus operations. For anyone still protecting accounts with SMS-delivered one-time codes, this is the recurring reminder: signaling-layer interception is a real, in-use capability, not a theoretical one.

What Enea observed

Per Enea's report, as covered by SecurityWeek and The Hacker News:

• Attacks come from hijacked operator equipment inside at least six Asian countries; Enea confirmed one operator's node was compromised.
• The group abuses SS7 (most activity) and sometimes Diameter signaling, which cross the shared IPX network between carriers.
• The core technique is location-update spoofing: SilentAir sends the target's home network an UpdateLocation message (or its Diameter equivalent) claiming the hijacked node now serves the target's phone. If the home network accepts it, inbound calls and SMS route through the attacker's node.
• Enea says it observed 2FA codes being intercepted immediately after the diversion took effect for some targets.
• Silent SMS — messages that never render on the handset — were sent mostly to Taiwanese subscribers at night, likely to check whether a diversion was still live.

Who's targeted

Mostly Taiwan, with other targets across Southeast and East Asian networks and occasional activity in East Africa, Central Asia, the Middle East, and Europe. Enea says some targets were political and government VIPs. The report does not name the operators or individuals.

Attribution — read it carefully

• Enea: high confidence state-level actor; low confidence China alignment, resting on the Taiwan focus, a UTC+8 working pattern, and pauses around Chinese public holidays.
• Enea notes SilentAir partly resembles SCTPE, a known Linux trojan, but behaves differently (it answered messages it never sent, which SCTPE cannot).
• Singapore's IMDA tracks the same tooling as SIGweaver and links it to Liminal Panda with moderate confidence, citing CrowdStrike. Enea calls a Liminal Panda link "possible but unconfirmed."

Translation: nobody is putting a flag on this with high confidence, and neither should you. The capability and the targeting are the story; the attribution is still forming.

Action checklist

1. Stop relying on SMS for second factors on anything that matters. Move high-value and VIP accounts to phishing-resistant MFA — passkeys / FIDO2 security keys — or at minimum app-based TOTP. SS7 diversion defeats SMS and voice OTP by design.
2. Flag executives and sensitive roles for account-takeover monitoring that doesn't depend on the mobile number: anomalous logins, new-device enrollment, mailbox-rule changes.
3. If you run a mobile network, deploy and tune a signaling firewall, and alert on anomalous UpdateLocation for subscribers who haven't roamed and on bursts of silent SMS.
4. Brief at-risk staff that unexpected loss of signal, or a phone that goes briefly unreachable, can indicate a diversion — not just a dead zone.

Context

SS7 interception keeps resurfacing because the protocol's trust model predates any notion of a hostile peer carrier, and the fix — phishing-resistant MFA plus carrier-side signaling firewalls — rolls out slowly. SilentAir is the latest named cluster to industrialize it against a specific geography. The practitioner takeaway hasn't changed in years: SMS 2FA is better than nothing and worse than almost anything else.