Enea details SilentAir, a group intercepting calls and SMS from hijacked mobile network nodes

Enea, a telecom software and cybersecurity company, has published an account of a threat actor it calls SilentAir, which intercepts phone calls and text messages by way of compromised mobile operator infrastructure. Taiwan is the main target. The write-up, reported by SecurityWeek on 13 November 2026, also covers a second group, Liminal Panda, and its GTPDoor backdoor.

What Enea reports

SilentAir is previously unknown to the company, which assesses with high confidence that it's a new state-level actor. The China-nexus attribution is much weaker: Enea believes with low confidence that the activity aligns with China-nexus operations, and gives three reasons. The interest in Taiwan, the absence of Chinese targets, and attack timing that fits a workday in China's time zone. That's a circumstantial case, and the company labels it as such.

The hijacked nodes belong to operators in at least six Asian countries. Beyond Taiwan, the group has targeted a dozen other countries and territories, with occasional activity against people in East Africa, Central Asia, the Middle East and Europe. High-profile political and government figures were among those targeted. Enea has monitored the attacks since early 2025, and further digging turned up suspicious activity from before that.

Separately, the report covers 2026 activity from Liminal Panda, which CrowdStrike linked to China-nexus operations with low confidence. Enea describes it as the only actor known to actively exploit the IPX, the interconnect network operators use to exchange traffic. From the first quarter of 2026, Enea says it spotted and blocked Liminal Panda's GTPDoor backdoor at several of its mobile operator customers, catching several hundred attempts to covertly reach command-and-control servers. It has seen potential infections at between five and ten operators, and estimates the total could reach several dozen, particularly in Asia, Africa and Latin America.

Enea says the two groups could be connected, though the evidence isn't strong enough to link them.

How the interception works

SilentAir's signaling attacks run mostly over SS7 and sometimes over Diameter, launched from nodes the group has already taken over at mobile operators. Routing a target's incoming calls and SMS through a compromised node is what lets the group read them, and the same position yields subscriber details. Location tracking is possible too, but Enea says it makes up only a small part of the activity. The group also sends silent SMS messages, which don't show up on the recipient's phone, possibly to check whether earlier interception attempts worked.

The mechanism matters more than the label. SS7 and Diameter are the control protocols operators trust between networks, and a node inside that trust boundary can redirect traffic without touching the handset. Nothing on the phone tells the subscriber anything is wrong. That's also why the fix isn't a user-side one: the exposure sits with the operator's signaling estate, not with the device.

Liminal Panda's angle is different. GTPDoor abuses the IPX layer, the commercial interconnect where operators hand traffic to each other. Enea's numbers on that are explicitly an estimate, not a count of confirmed compromises.

HackZoneLabs assessment

The interesting part of this report is the split between what Enea is confident about and what it isn't. High confidence on a new state-level actor, low confidence on China, and an explicit statement that the two groups may be related but the evidence doesn't carry it. We'd read that as a company being careful with attribution it can't prove, which is worth noting given how often that step gets skipped.

The Liminal Panda figures deserve the same caution. Five to ten potential infections is what Enea has seen at its own customers, and "several dozen" is an estimate about the wider field. Neither is a measurement of how many operators are compromised. In our view, the more useful signal is that GTPDoor was caught at the interconnect layer at all, because that's a place many operators don't watch closely.

On SilentAir, the practical weight sits with the operators in the affected countries. A subscriber can't audit a signaling path, and switching to an encrypted messaging app changes what's exposed but not the routing problem underneath.

What remains unknown

The report doesn't say how many subscribers had calls or messages intercepted, or how the operators' nodes were initially compromised. It doesn't name the operators in the six countries. There's no published list of indicators, and no word on whether the hijacked nodes have been cleaned up. Whether SilentAir and Liminal Panda share infrastructure or staff is unresolved by Enea's own account.

For defenders at operators, the priorities the report supports are signaling monitoring for unexpected routing changes and silent SMS patterns, and scrutiny of interconnect peers. For everyone else, there's little to act on beyond knowing that interception at this layer leaves no trace on the handset.