SilentAir Took Text-Message Login Codes Inside Asian Mobile Networks, Not on the Phone. Move Your Highest-Risk Users Off SMS Codes.
If anyone in your organization signs in to email, admin consoles, banking or a VPN with a code sent by text message, move them to a passkey or a FIDO2 security key, starting with administrators, executives, finance staff, and anyone who travels to or does business in Taiwan or the rest of East and Southeast Asia. On November 11, the Swedish telecom security company Enea reported that a group it calls SilentAir sent attacks from hacked equipment inside Asian mobile operators, rerouted chosen people's texts and calls to itself, and, in Enea's words, "observed intercepted two-factor authentication codes immediately after interception for some targets." Nothing happened on the victim's phone. The code was taken in the network between the bank or the email provider and the handset.
Enea says the group has been disrupted for now and that the conditions for it, or another group, to come back are still there. The fix on your side does not depend on whether this group returns: a code sent by text message travels through a system you cannot see or protect.
What Enea confirmed
All of this is from Enea's post, "The Enemy Within: Tracking LIMINAL PANDA and SilentAir through Mobile Networks," published November 11 and updated November 12 with a key-takeaways section.
Who. Enea assesses "with high confidence" that SilentAir is a "state-level actor," not a commercial surveillance company. It links the activity to China only with low confidence, citing the focus on Taiwan, the absence of Chinese targets, working hours that match a UTC+8 day, and government and political targets.
Where it sat. Enea identified suspicious network elements in "at least 6 different Asian countries." The attacks came from inside those operators, from compromised equipment using network addresses (SCCP Global Titles) that resemble the operators' own legitimate equipment. Enea says it informed the affected operators.
Who it hit. Mainly subscribers in Taiwan, plus attacks against about a dozen other countries and territories. The Hacker News lists Southeast and East Asia and, at times, East Africa, Central Asia, the Middle East and Europe. Some targets were political and government figures. Enea reports one burst that targeted several thousand subscribers over a month.
How. Mostly SS7, sometimes Diameter, the signaling systems mobile networks use to tell each other where a phone is and where to deliver its calls and texts. The interception step is a forged UpdateLocation message: the attacker's node tells the victim's home network that it is now serving the victim's phone, so later texts and calls are delivered to the attacker. The traffic crossed the IPX, the private exchange operators use to connect to each other.
What it took. Texts and calls of selected people. Interception made up 18.3 percent of the SilentAir attacks Enea observed, against 2.07 percent for a typical surveillance company in Enea's earlier data. For some targets Enea saw two-factor codes intercepted right after the diversion, which it reads as attempts to get into other accounts.
Silent SMS. The group sent large volumes of silent text messages, mostly to Taiwanese subscribers around midnight. Enea thinks these checked whether earlier diversions were still in place.
When. Unusual signaling attacks since early 2025, with earlier suspicious activity found in follow-up analysis, in bursts separated by months of quiet.
What is not known
Which operators and which countries. Enea does not name them, and neither does the press coverage we read.
Whether the equipment has been removed. Enea says the groups were disrupted for now. It does not say the compromised equipment is gone.
Whether any account was actually taken over. Enea saw codes intercepted. It does not report what happened next.
Whether subscribers of the infected operators were also targeted. Enea's sensors could not see traffic inside those operators' own networks, so the count of targets may be low.
The malware. Enea could not analyze the implant it believes SilentAir used. The behavior resembles SCTPE, a kernel-level Linux trojan that handles SS7 and Diameter traffic, but SilentAir did things SCTPE is not known to do, so Enea does not tie them together. Singapore's IMDA links SCTPE (CrowdStrike calls it SIGweaver) to the group LIMINAL PANDA with moderate confidence, according to Enea. Enea calls a SilentAir link to LIMINAL PANDA "possible but unconfirmed."
What to do
Enea's recommendations are written for mobile operators. It gives no advice to the people whose texts and calls were targeted, so steps 1 through 4 are ours.
Move privileged and high-risk users to phishing-resistant sign-in. Passkeys or FIDO2 security keys for administrators, executives, finance and payroll staff, help desk staff who can reset accounts, and anyone whose job or travel puts them in Taiwan or the region. Neither a passkey nor a security key sends anything over the phone network, so this attack has nothing to intercept.
Treat SMS as recovery-only, then close the recovery door too. Where text-message codes stay for convenience, keep them off accounts that can reset other accounts. Check what your identity provider and your email provider accept for account recovery. A strong primary sign-in with a text-message reset is still a text-message account.
Authenticator apps are a step up from SMS, not the end point. An app-generated code never crosses the phone network, so this attack does not reach it. It can still be typed into a fake sign-in page, which a passkey cannot be.
Watch for the follow-on, not the interception. You will not see a diversion. You can see a sign-in that follows one: a successful login right after a text-message code was sent, from a new device or location, or a recovery or MFA change on an executive's account. Alert on those for the users in step 1.
If you buy mobile service at scale, ask your carrier. Ask whether it runs signaling firewalls on SS7, Diameter and GTP at its interconnect, and whether those systems share information with each other, which is what Enea recommends. Ask whether it treats the IPX as untrusted ("must be regarded as untrusted," in Enea's words) and whether it monitors signaling inside its own network, not just at the border. The GSMA publishes interconnect security guidelines by protocol: FS.11 for SS7, FS.19 for Diameter, and FS.20 for GTP. Asking whether those are implemented is a fair question. Enea says such industry recommendations should be the start, not the end point, of signaling security. Most of those GSMA documents are restricted to GSMA members, and we could not open GSMA's pages, so we do not describe their contents here.
What we did, and what we cannot see
Our sensors cannot see this. Our edge shield and honeypots see web traffic. SS7, Diameter and GTP signaling between mobile operators never reaches them, so we did not run an edge check and we make no claim about whether this activity touched anyone we protect.
We checked our own archive first. Our blog, indicator and adversary indexes had nothing on SilentAir or LIMINAL PANDA before today. Our nearest earlier work is the SIM swap stack in "Follow the Followers: The SIM Swap Stack We Found in the Samsung Leak's Shadow" (www.dugganusa.com/post/follow-the-followers-the-sim-swap-stack-we-found-in-the-samsung-leak-s-shadow), a different route to the same stolen text-message code.
We added the two indicators Enea published. Enea's post lists two MD5 file hashes, both malware samples, neither a SilentAir network indicator: 35f0d4d0c5519a2957338e448fce53bc for GTPDoor version 3, a LIMINAL PANDA backdoor that now hides its commands in GTP-U user traffic, and da35d98c9a22e8ede93595d21fe7e63e for SCTPE. The GTPDoor hash was not in our corpus before today; a rate limit stopped our check on the SCTPE hash before ingest. We ingested both under source manual-batch-silentair-2026-11 with Enea's post as the reference, attributed to LIMINAL PANDA, and confirmed both by read-back. They are Enea's research, carried in our feed, not our own detection. They matter most to operators and to anyone running Linux on telecom core equipment.
No network indicators exist to block. Enea published no SilentAir IP addresses, domains or Global Titles in the sources we read. The compromised operator equipment is a victim, and we would not put a hacked carrier's equipment on a blocklist even if it had been named.
Our feed is free to register for, and the hashes above are in it. For this story the real protection is step 1.
Sources
Enea, "The Enemy Within: Tracking LIMINAL PANDA and SilentAir through Mobile Networks," November 11, 2026, updated November 12 (the primary): www.enea.com/insights/the-enemy-within-tracking-liminal-panda-and-silentair-through-mobile-networks/
The Hacker News, SilentAir coverage, November 13, 2026 (the lead that sent us to Enea): thehackernews.com/2026/11/silentair-hijacks-asian-telecom.html
GSMA document listings for FS.11, FS.19 and FS.20, as named in search results; the GSMA pages themselves returned HTTP 403 to us.
Limits
We read Enea's post through a fetching tool after Enea's web firewall blocked a direct download, so our quotes are short and we paraphrased the rest. We checked the two hashes against two separate reads of the page and they matched. We did not read Singapore's IMDA advisory or CrowdStrike's reporting on SIGweaver, and we rely on Enea's summary of both. We did not obtain or analyze any sample. The table in our diagram comparing sign-in methods is our reading of how the attack works, not a finding Enea reports.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments