Telecom software and cybersecurity company Enea has detailed a previously unknown threat actor that intercepts phone calls and text messages through compromised mobile operator infrastructure, with Taiwan as its main target. Enea tracks the group as SilentAir and assesses with high confidence that it is a new state-level actor.
Enea’s researchers believe with low confidence that SilentAir’s activity aligns with China-nexus operations. The company cites the group’s interest in Taiwan, the absence of Chinese targets and attack timing consistent with a workday in China’s time zone.
Signaling attacks through hijacked nodes
SilentAir launches signaling attacks mostly over SS7 and sometimes over Diameter from network nodes it has hijacked at mobile operators. The attacks route a target’s incoming calls and SMS messages through the compromised node and harvest subscriber details. The hackers can also track a target’s location, although this accounts for only a small part of their activity. They send silent SMS messages that do not appear on the recipient’s phone, possibly to check whether earlier interception attempts succeeded.
Enea has monitored the attacks since early 2025, and further investigation revealed suspicious activity from before that period. The hijacked nodes belong to operators in at least six Asian countries. Besides Taiwan, the group has targeted a dozen other countries and territories, occasionally going after people in East Africa, Central Asia, the Middle East and Europe. High-profile political and government figures were among those targeted.
Liminal Panda and IPX exploitation
Enea also described 2026 activity from Liminal Panda, a group CrowdStrike linked with low confidence to China-nexus operations. Enea says Liminal Panda is the only actor known to actively exploit the IPX, the interconnect network that mobile operators use to exchange traffic.
Starting in the first quarter of 2026, Enea spotted and blocked Liminal Panda’s GTPDoor backdoor at several of its mobile operator customers. In total, it caught several hundred attempts to covertly reach command-and-control servers. Enea says it has seen potential infections at between five and ten operators. It estimates that the total could reach several dozen, particularly in Asia, Africa and Latin America.
Enea says SilentAir and Liminal Panda could be connected, although the evidence is not strong enough to link them.