Spies Inside the Phone Network: SilentAir Diverted Texts and Grabbed Login Codes the Moment They Arrived
A newly named state-level group, SilentAir, used hacked equipment at mobile operators in at least six Asian countries to reroute targets’ calls and texts. In some cases researchers watched two-factor codes being intercepted right after a diversion took effect, a sharp reminder of the limits of SMS-based login codes.
Text-message login codes rest on a simple assumption: only your phone receives the message. A report published this week describes a group that broke that assumption from inside the mobile network itself, by hijacking equipment at telecom operators and telling other networks that a target’s phone had moved. In some cases the group’s first move after a successful diversion was to collect a two-factor authentication code.
This briefing is based on The Hacker News coverage of the research, with additional details from SecurityWeek.
Who found it, and who is behind it
The research comes from Enea, a Stockholm-based telecom and cybersecurity software company, which named the group SilentAir. Enea assesses with high confidence that SilentAir is a state-level actor. Its link to China is rated only low confidence and rests on circumstantial signs: the group focused on Taiwan, never targeted Chinese networks or subscribers, and its tracking and interception worked a 9 a.m. office day in China’s time zone, nearly stopping on weekends and slowing around Chinese holidays. Enea also considered a connection to Liminal Panda, a group known for earlier telecom intrusions, and called it possible but unproven.
How the interception worked
Mobile operators exchange signaling messages over the SS7 and Diameter protocols to route calls and texts and to support roaming. That traffic travels over a shared interconnect known as the IPX, which depends on operators trusting one another. SilentAir sent its attacks into the IPX from compromised equipment inside operators in at least six Asian countries.
To intercept someone, the group sent the target’s home network a location update claiming that the hacked equipment was now serving that person’s phone. When the home network accepted the claim, incoming calls and texts were sent to the attackers instead. Enea saw some of these diversions succeed, and for certain targets it saw 2FA codes intercepted right after the redirect took hold, which suggests attempts to get into other accounts belonging to those people. The report does not say whether any account was actually taken over, and it offers no comparable evidence for voice calls.
Silent texts as a test signal
SilentAir also sent very large numbers of “silent SMS,” messages a phone neither displays nor alerts on, mostly to subscribers in Taiwan. Enea believes one key use was to check whether a diversion was working: if the test message landed on the hacked equipment rather than the handset, the attackers knew they had that person’s texts. Most of these messages went out at night, when phones are least likely to re-register at their real location. The texts carried spam-like motivational or promotional lines, which Enea thinks were a disguise in case a carrier stripped the silent flag and the message appeared on screen.
Scale and targets
- Interception made up 18.3% of the SilentAir attacks Enea observed, compared with 2.1% for a typical surveillance company in Enea’s earlier research.
- Targets included political and government VIPs. Outside Taiwan, most were on other Southeast and East Asian networks, with occasional targets in East Africa, Central Asia, the Middle East and Europe.
- Activity came in bursts, from a handful of subscribers to several thousand in a month, separated by quiet periods lasting months.
- Enea has tracked the activity since early 2025 and found signs of it earlier. It says SilentAir is disrupted for now but could return, and that any attacker could reuse these techniques.
What Enea told operators
The recommendations are aimed at carriers, not consumers: deploy firewalls for the GTP protocols that carry mobile data and link them with SS7 and Diameter firewalls, go beyond baseline signaling-security guidance, add detection for signaling traffic inside their own networks, and connect signaling security with the rest of their IT security. The report does not name the countries, operators or targets, and it offers no advice for people whose phones may be targeted.
What this means for your company
Most small businesses will never be a target of a state-level group like this one. Still, the research shows plainly that a code sent by text message is only as secure as every network that message passes through, and you control none of them. Practical takeaways:
- For email, remote access, banking, payroll and admin consoles, move staff from SMS codes to an authenticator app, a hardware security key or passkeys wherever the service supports them.
- Do not use texted codes as the only check when resetting a password or approving a large payment. Add a second, independent confirmation.
- Give extra protection to executives and staff who travel internationally, since their phones register on foreign networks.
- Keep SMS as a fallback only where nothing stronger is available, and review which accounts still depend on it.
If you are not sure how many of your company’s logins still rely on a text message, we can help you find them and plan a move to stronger options. Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
