SilentAir Used Hacked Asian Telecom Equipment to Intercept SMS 2FA Codes in Taiwan
Enea identified a spying group it called SilentAir operating from hacked equipment inside at least six Asian mobile operators. The group used SS7 and Diameter signaling to divert calls and texts, intercepting SMS two-factor authentication codes for selected people, mostly in Taiwan. The case shows how trust-based telecom signaling can undermine SMS-based authentication and expose high-value users.
Enea said it found SilentAir attack sources in at least six Asian countries and assessed with high confidence that the group is a state-level actor, while linking it to China only with low confidence. The group sent signaling attacks into the IPX roaming network from hacked operator equipment, using SS7 or Diameter UpdateLocation messages to claim it was serving a target phone. If accepted, calls and texts were diverted; for some targets, SMS two-factor authentication codes were intercepted.
The company said interception made up 18.3% of SilentAir attacks it observed, compared with 2.1% in its earlier research on typical surveillance firms. It also saw bursts from one or a few subscribers to several thousand over a month, with gaps lasting months or longer. Evidence inside one operator showed equipment both sending and receiving attack commands, supporting takeover rather than spoofing. SilentAir also sent large volumes of silent SMS, mainly to subscribers in Taiwan.
SS7 and Diameter are legacy mobile signaling protocols used to route calls, texts and roaming across a shared IPX network built on trust between operators. That design makes diversion possible when an attacker can present itself as a legitimate network element. Enea said SilentAir understood signaling defenses well enough to evade detection at first, and that equipment in several countries worked together against some targets, pointing to a single controller. The company notified operators and said SilentAir was disrupted for now.
The finding exposes a structural weakness in the second-factor model used by banks, cloud services, messaging apps and government accounts. SMS codes were meant to protect logins, but the report shows they can be diverted at the telecom layer, where users and many service providers cannot see the attack. Targets included political and government VIPs, and some interceptions occurred immediately after diversion, indicating attempted account access. The source did not confirm account takeover or whether operators removed the hacked equipment.
It affects anyone who uses SMS codes for banking, email, messaging or government accounts, because attackers can intercept those codes at the telecom network layer. It also raises exposure for political and government figures targeted through compromised roaming infrastructure.
Sources (1)
- [1]Original source(https://thehackernews.com/2026/11/silentair-hijacks-asian-telecom.html)