SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users
AI-summarised brief · reviewed before publication
Enea, a Stockholm‑based telecom and cybersecurity firm, disclosed a covert spying operation named SilentAir that compromised equipment inside at least six Asian mobile operators to hijack SS7 and Diameter signaling. By injecting fraudulent UpdateLocation messages into the inter‑operator IPX network, the group rerouted calls and SMS for selected users—predominantly in Taiwan—allowing interception of two‑factor authentication codes. Interception accounted for 18.3% of SilentAir’s observed attacks, far above the 2.1% typical for similar threats. Targets included political and government figures, and in rare instances multiple compromised operators coordinated against a single individual, suggesting a single controller. The campaign ran in bursts from early 2025, spanned Southeast Asia, East Africa and Europe, and was temporarily disrupted after Enea alerted the carriers for remediation.
💡 Why It Matters
- · By exploiting trusted inter‑operator signaling, SilentAir proved that state‑grade actors can silently breach the core of mobile communications, exposing the fragility of 2FA that many users and enterprises rely on.
