Actively exploited Security news
SilentAir: a state-level actor reroutes calls and SMS through hijacked mobile operators, mainly targeting Taiwan
Mobile network security vendor Enea published research on 11 November 2026 into a threat actor it calls SilentAir. According to Enea, the group controls network elements inside operators in at least six Asian countries and injects signalling into the international interconnect that diverts selected people's calls and text messages to itself. Some victims received two-factor authentication codes right after interception. Here is what is confirmed, and what it means for operators and for everyday users.
Key points
- On 11 Nov 2026 Enea named a new actor, SilentAir. It assesses with high confidence that it is a state-level actor rather than a surveillance vendor, and with only low confidence that it aligns with China-nexus operations.
- SS7 and Diameter attacks originate from compromised elements inside operators in at least six Asian countries and target operators and subscribers in about a dozen more countries and territories. Taiwan is the primary target.
- The core technique is a spoofed UpdateLocation: the network then delivers the victim's calls and SMS to the attacker's node. Some targets received 2FA codes immediately afterwards.
- Enea sees possible but unconfirmed links to LIMINAL PANDA, a group that hits operators with the GTPDoor backdoor, and documents a new GTPDoor v3.
- Published indicators are two MD5 hashes (GTPDoor v3 and the SCTPE tool). The report does not list specific Global Titles.
What happened
Enea, a vendor of signalling security for mobile operators, published research on 11 November 2026 into a new threat actor it calls SilentAir. The analysis was coordinated with the Cyberforce team at Luxembourg operator POST Luxembourg.
According to Enea, SilentAir controls network nodes inside compromised operators and uses them to inject spoofed SS7 and Diameter messages into the operators' international interconnect (IPX). Enea has seen unusual signalling from some Asian networks since early 2025, and follow-up analysis found suspicious activity from even earlier. The attacks come in bursts separated by months of silence.
Enea assesses with high confidence that SilentAir is a state-level actor, not a commercial surveillance vendor. It rates alignment with China-nexus operations at only low confidence: activity follows a UTC+8 working pattern and pauses around Chinese holidays, and Chinese networks were not targeted.
How the attack works
Enea names the operations involved. Information harvesting uses the SS7 MAP messages SendRoutingInfoForSM, RestoreData and SendAuthenticationInfo; location tracking uses AnyTimeInterrogation, which Enea says is only a small part of the activity. The heart of the campaign is interception: a spoofed UpdateLocation tells the victim's home network that the phone has registered elsewhere, so future calls and SMS are routed to the attacker's node. On 4G, SilentAir uses the equivalent Diameter messages (Authentication-Information-Request, Insert-Subscriber-Data-Request, Update-Location-Request).
For some targets, Enea saw two-factor authentication codes arrive immediately after interception - which, it says, suggests attempts to break into the victims' other accounts. The actor also sent silent SMS at large scale, mostly to Taiwanese numbers and sometimes with spam-like text, through interim SMS centres usually located in Southeast Asia. Enea believes these test whether earlier redirections are still active.
Who is affected
- Targets: primarily Taiwan, plus operators and subscribers in about a dozen more countries and territories across Southeast and East Asia, and at times East Africa, Central Asia, the Middle East and Europe (Enea does not name European countries). Targets included political and government VIPs.
- Origin of the attacks: Enea identified SilentAir-related network elements at operators in at least six Asian countries, in some cases several operators per country.
- Ordinary users are rarely a target - this is surveillance of selected people. It does, however, highlight a weakness of SMS codes that applies wherever you live.
The LIMINAL PANDA connection
The same report covers LIMINAL PANDA, which CrowdStrike described in November 2024 as a telecom-focused actor active since at least 2020. Enea detected its GTPDoor backdoor in multiple customer operators from Q1 2026 and documents a new GTPDoor v3 that communicates over user-plane GTP-U instead of GTP-C, making it harder to spot. Enea counts at least 5-10 operators infected by LIMINAL PANDA, possibly several dozen.
Enea does not confirm that the two are the same: they share some infected networks, targeting in Asia and the SCTPE tool, but SilentAir also answers transactions it did not start and shows stronger operational security.
How to tell if you were compromised
Enea published only two indicators (MD5). It does not list Global Titles, point codes or IP addresses.
35f0d4d0c5519a2957338e448fce53bc GTPDoor v3
da35d98c9a22e8ede93595d21fe7e63e SCTPESearch EDR telemetry and sample stores on Linux core-network servers for these hashes; our IOC extractor pulls them out of logs right in your browser. At the signalling level, watch for UpdateLocation and Update-Location-Request for your own subscribers who are not actually travelling, bursts of SendAuthenticationInfo/AIR, and mass silent SMS.
What to do
Operators (Enea's recommendations):
- Deploy GTP-C and GTP-U security and align it with your SS7 and Diameter firewalls so visibility is shared across protocols.
- Go beyond industry baseline recommendations for signalling security.
- Treat the IPX interface as untrusted, including DNS and ICMP.
- Analyse internal signalling, not just traffic at the network edge.
- Integrate signalling security with your wider security operations.
- If your core network is outsourced, make sure you retain ownership of data and visibility for investigations.
Users (our advice - Enea's report has none for individuals): for email, banking and work accounts, prefer an authenticator app, passkey or hardware security key over SMS codes. See How to turn on two-step verification.
Timeline
- 2020 - LIMINAL PANDA active since at least this year (CrowdStrike).
- 19 Nov 2024 - CrowdStrike publishes its LIMINAL PANDA analysis.
- Early 2025 - Enea first observes unusual SilentAir signalling.
- Q1 2026 - Enea detects GTPDoor at customer operators.
- July 2026 - POST Luxembourg publicly reports detecting GTPDoor.
- 11 Nov 2026 - Enea publishes its SilentAir and LIMINAL PANDA research; key takeaways added 12 Nov.
FAQ
Could someone read my text messages this way?
The campaign targets selected individuals, not entire customer bases, and Enea lists Europe only as an occasional target region without naming countries. But the underlying weakness - SMS can be rerouted through international signalling - is not tied to any one country, so for important accounts you should not rely on SMS codes alone.
Is SMS two-factor authentication still worth having?
An SMS code is still far better than a password alone. If an attacker can reroute your SMS, though, they get the code too. Authenticator apps, passkeys and hardware security keys do not travel over the mobile network, so this kind of interception does not capture them.
What are SS7 and Diameter?
They are the signalling protocols operators worldwide use to exchange subscriber information - where a phone is, where to deliver a call or SMS, authentication data for roaming. SS7 serves 2G and 3G networks, Diameter serves 4G. Operators have traditionally trusted messages from the interconnect, which is why an attacker inside one operator is dangerous to others.
Is SilentAir the same as LIMINAL PANDA?
Enea does not say so. The two overlap in timing in some infected operators, in targeting in Asia and in the SCTPE tool. But SilentAir also responds to transactions it did not initiate, which known SCTPE behaviour does not explain, and its operational security appears stronger, so Enea tracks them separately.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
Cairn: CL-STA-1238 let autonomous AI agents attack chipmakers, defense firms and nonprofits
On 12 November 2026 Unit 42 (Palo Alto Networks) published an analysis of a campaign in which a China-nexus actor used a customized fork of the open-source Cairn framework. In August and September 2026 its AI agents ran 25 operations against at least 19 organizations largely on their own, from reconnaissance to persistence. Nothing about it was novel: weak passwords, open registration endpoints and old bugs. Here is what is confirmed, the indicators, and what it means for defenders.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
FBI disrupts North Korea's FaceStealer fake video call campaign as the US moves to seize $1.2 billion from the Binance theft
On 12 November 2026 the US Department of Justice announced two actions against North Korean cryptocurrency theft. The FBI disrupted cloud infrastructure behind FaceStealer, a campaign that lures crypto workers and open-source developers into fake video calls and installs malware disguised as a fix for an audio problem. Separately, a court authorised the seizure or restraint of more than $1.2 billion from the theft of over $6 billion from Binance on 29 October. Here is how the trick works and what to do if you joined one of these calls.