Science & Tech · Cybersecurity · 13 hrs ago
Hackers used compromised Asian mobile networks to intercept calls and texts
Enea identified a group called SilentAir that used compromised mobile operator equipment to intercept calls and text messages.
The group’s main target was subscribers in Taiwan, though it also targeted people in a dozen other countries and territories.
It launched attacks through hijacked network equipment in at least six Asian countries, using systems mobile operators rely on to exchange traffic.
SilentAir also sent hidden text messages and collected subscriber details; some intercepted messages included two-factor login codes, which could help attackers access other accounts.
Enea is highly confident the group is a state-level actor, but says a possible connection to China-linked operations is uncertain.
Enea also reported attacks by a separate group, Liminal Panda, and said the two groups might be connected, though evidence is weak.
Enea says it helped operators remove Liminal Panda activity and alerted operators hosting SilentAir equipment, but warned the groups or others could return.
Enea reported that a newly identified actor called SilentAir used compromised mobile operator networks to intercept calls and text messages, mainly targeting subscribers in Taiwan.
The company assessed with high confidence that SilentAir was a state-level actor, but linked it to China-nexus operations only with low confidence.
SilentAir launched attacks through hijacked network equipment in at least six Asian countries and targeted people in a dozen other countries and territories.
Enea also reported blocking Liminal Panda activity, including attempts to reach command-and-control servers, at several mobile operator customers from early 2026.
Enea said the two groups might be connected, but the evidence was not strong enough to establish a link.
- Who
- SilentAir, a newly identified threat actor that Enea assesses with high confidence is state-level.
- What
- It used compromised mobile operator infrastructure to intercept calls and text messages, mainly targeting subscribers in Taiwan.
- When
- Enea monitored SilentAir from early 2025; its research was published on November 11, 2026.
- Where
- Hijacked operator nodes in at least six Asian countries were used; targets were in Taiwan and a dozen other countries and territories.
- Why
- Not stated. Enea said the actor’s motives were unclear.
This story does not have two clearly opposing sides.
Enea began monitoring SilentAir’s attacks.
Enea published research naming SilentAir and discussing Liminal Panda.
Enea spotted and blocked Liminal Panda activity at several customer operators.
- Actor
- SilentAir
- Main target
- Taiwan
- Hijacked operator nodes
- At least six Asian countries
- Other targets
- A dozen other countries and territories
- Interception share
- 18.30% of SilentAir’s activity
- Potential Liminal Panda infections
- Five to 10 operators, according to Enea
3 sources
What people are saying
both groups had been set back for now, but warned the conditions remained for them, or others, to return