A newly named state-level group, SilentAir, has been using compromised Asian carriers to eavesdrop on calls and texts, including one-time login codes. The research is a sharp reminder that the phone network itself can be an attack surface, and that SMS remains a weak link for authentication.
What happened
Telecoms security vendor Enea published research on 11 November 2026, updated a day later, describing two threat actors working inside the global mobile interconnect. The first is a previously unreported group Enea calls SilentAir. The second is Liminal Panda, an actor already known for attacking telecoms operators, which Enea says has upgraded its GTPDoor backdoor.
According to Enea, SilentAir has been active since at least early 2025. It sends malicious SS7 and Diameter signalling messages from equipment it has compromised inside operators in at least six Asian countries, and has aimed that traffic at subscribers in roughly a dozen further countries and territories. Taiwan is the main focus. Enea says some targets were political and government figures, and that Europe was occasionally in scope.
Enea says it has high confidence that SilentAir is a state-level actor rather than one of the commercial surveillance firms that account for most signalling abuse. Its link to China is much less certain. Enea rates the China-nexus alignment as low confidence, pointing to the Taiwan focus, an absence of Chinese targets, activity that fits a UTC+8 working day and pauses around Chinese public holidays. Enea has notified operators hosting SilentAir infrastructure and says both groups have been set back for now but could return.
The technical picture
SS7 and Diameter are the signalling protocols that let operators talk to each other: they route calls and texts, look up where a roaming subscriber is, and exchange authentication data. Much of this traffic passes through IPX providers, the private exchanges that connect hundreds of operators. The model was built on mutual trust, and an attacker who controls a node inside one operator inherits a share of that trust.
What sets SilentAir apart, on Enea’s figures, is its emphasis on interception rather than simple location tracking. Infosecurity Magazine reports that interception made up 18.30% of SilentAir’s activity, compared with 2.07% for the surveillance vendors behind most signalling attacks. Enea describes the core technique as malicious location updates: the network is persuaded that a subscriber is somewhere they are not, so calls and SMS are steered towards attacker-controlled infrastructure.
The most telling detail is that, for some targets, two-factor authentication codes arrived shortly after interception began. Enea reads that as evidence the attackers wanted access to the victims’ other accounts, not only their conversations. SilentAir also sent large volumes of silent SMS, messages that never appear on the handset, mostly to Taiwanese numbers around midnight. Enea suggests some may have been used to test whether the location-update attacks had worked.
Risky Bulletin notes that SilentAir is only the second known state group, after Russia’s HiddenArt, seen exploiting telephony signalling in this way, and that its malware foothold inside operators gave it a more stable operation.
On Liminal Panda, Enea says its firewalls blocked several hundred attempted command-and-control exchanges at customer operators from early 2026. It counts five to ten operators as confirmed or strongly indicated infections, and thinks the real number could be several dozen across Asia, Africa and Latin America. The new GTPDoor v3 hides its commands inside GTP-U, the user-data side of the GPRS Tunnelling Protocol. Enea says that traffic is far heavier and less closely monitored, and it carries over into 5G. Enea sees overlaps in timing and targeting between the two groups, and the two have sometimes been inside the same networks at once, but it has not confirmed any cooperation.
Why it matters for UK organisations
None of the sources mention UK victims, and nothing here suggests UK networks were compromised. The relevance is my own reading, and it rests on how the interconnect works. Enea argues that compromising a single carrier among the 800-plus worldwide effectively opens a route to the rest. A British executive roaming in Asia, or a UK subscriber whose home operator accepts signalling from a compromised partner, sits inside the same trust fabric that SilentAir abused.
The second point is closer to home for most security teams. A great many UK organisations still rely on SMS codes for staff remote access, customer account recovery and payment confirmation. This research shows a well-resourced actor deliberately collecting those codes at the network layer, where no amount of user awareness training helps. If your threat model includes state-level interest in your senior people, SMS should not be what stands between an attacker and their mailbox.
For UK operators, the findings land on existing obligations under the Telecommunications (Security) Act framework, which already expects providers to manage signalling and supply chain risk. Enea’s advice to treat the IPX as untrusted, and to monitor signalling inside the network as well as at the edge, is a useful benchmark for boards asking whether those controls are working in practice.
Expert view
When we run adversary simulation against organisations, the mobile network is usually treated as out of scope: it belongs to the carrier, so it gets assumed safe. SilentAir is a good illustration of why that assumption is fragile. Nothing suggests the attacker touched the victims’ devices or their employers’ systems. It simply sat in the plumbing between operators and waited for the messages to flow past.
In my experience, the organisations most exposed to this sort of thing are not the ones with weak perimeters, but those whose high-value people move around: diplomats, senior executives, journalists, deal teams. Their identity often hangs off a phone number that can be silently redirected.
I would also urge caution on attribution. Enea is open that its China link is low confidence, built on targeting, timing and holiday patterns. Such indicators can be imitated. The tradecraft is what matters, and it is clearly within reach of more than one state.
What to do now
- Retire SMS codes for privileged and high-risk users. Move administrators, executives and finance staff to phishing-resistant methods such as FIDO2 security keys or passkeys. This strengthens the user access control and MFA expectations in Cyber Essentials.
- Review account recovery paths. Check whether password resets for email, cloud consoles and banking portals can still be completed with a text message alone, and close those routes for sensitive accounts.
- Brief travelling staff. Encourage end-to-end encrypted apps for sensitive calls and messages when abroad.
- Ask your carrier the right questions. Larger organisations should ask their mobile provider how it filters SS7, Diameter and GTP traffic, whether it monitors internal signalling, and how it handles suspicious location updates.
- Operators: treat the interconnect as hostile. Follow Enea’s guidance on unified GTP, SS7 and Diameter security, integrate signalling monitoring with the wider security operations function, and scrutinise outsourced core network management.
Bottom line
SilentAir shows that a capable state actor can intercept calls and one-time codes apparently without going near a victim’s phone or employer. The China link remains tentative, but the lesson for UK organisations is firm: the mobile network is shared, trust-based infrastructure, and SMS should no longer protect anything that matters.
