Enea, a telecom security firm, said on its blog that it has tracked a new hacking group, which it calls SilentAir, since early 2025. Enea said the group sends attack commands over the links that connect mobile operators, mostly using the SS7 phone protocol and sometimes Diameter. The commands come from compromised systems inside infected operators. Enea found such systems in at least six Asian countries. It saw them attack operators and subscribers in a dozen more countries and territories. Taiwan was the main target. The commands included location tracking, information gathering, and call and SMS interception.
Enea said it has high confidence that SilentAir is a state-level actor, not a surveillance company. It has only low confidence that the group aligns with China-nexus operations. Enea could not analyse the group's malware, because the attackers hid their traces well. Other countries are suspected but not confirmed, and Enea believes the true scale is larger. Attacks came in bursts, from a few subscribers to several thousand in a month, with gaps of months. Enea said a possible link to a second group, LIMINAL PANDA, is unproven and did not shape its view.
Enea says the trust between mobile operators makes global roaming work, and also draws attackers. Anyone whose service sends calls or texts across mobile networks relies on that trust, and on carriers' defences they cannot inspect.