SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users

A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan.

Enea, a telecom and cybersecurity software company based in Stockholm, found the group's attack sources in at least six Asian countries and named it SilentAir this week.

It assessed with high confidence that SilentAir is a state-level actor, but linked its activity to China only with low confidence.

The company has told the operators where it found SilentAir sources, and the report does not say whether those operators have cleaned up the hacked equipment.

For some targets, the company observed two-factor authentication (2FA) codes being intercepted immediately after the diversion took effect.

That points to an attempt to break into other accounts registered to those people; the report gives no similar evidence for voice calls, and it does not say whether any account was taken over.

It said SilentAir has been disrupted for now but could return, and people using the hacked operators' own networks may also have been targeted, but the company could not see that traffic.

The company then saw equipment inside one operator both send and receive attack commands, which confirmed the second explanation, and it could not analyze the malware it believes SilentAir used.

For interception, SilentAir sent the target's home network an UpdateLocation message, or its Diameter equivalent; detecting and blocking the attacks was hard at first because the attackers understood mobile networks and signaling defenses well.

They may be a bulk check that earlier diversions were still in place, since phones are least likely to re-register to their real location at night.

The company blocked the group's GTPDoor traffic there and saw Liminal Panda infections, or strong signs of them, in at least 5 to 10 operators.