SilentAir: Suspected State Actor Compromises Asian Telecom Infrastructure to Intercept SMS and Calls

What Happened

Enea, a Stockholm-based telecom and cybersecurity software vendor, has identified a previously undocumented threat actor it calls SilentAir. According to Enea's reporting, the group used compromised equipment inside mobile network operators across at least six Asian countries. It used that access to intercept calls and SMS messages belonging to targeted individuals, with a focus on users in Taiwan. Enea assesses with high confidence that SilentAir is a state-level actor. The specific sponsoring nation has not been publicly disclosed in the reporting available at this time.

Why It Matters

Interception at the telecom infrastructure layer is a serious class of compromise. It bypasses endpoint and application-level defenses, because the attacker sits inside the carrier network rather than on the victim's device. SMS interception matters because SMS is still widely used to deliver two-factor authentication (2FA) codes. Compromised telecom infrastructure can therefore enable account takeover in addition to direct surveillance of calls and texts. Organizations and individuals in Taiwan, and potentially in the other affected countries, whose accounts or communications rely on SMS should consider themselves part of the affected population, even without individual notification.

What Defenders Should Watch For

• Telecom operators and MSSPs serving carriers in the region should review signaling infrastructure (such as SS7/Diameter-adjacent systems, HLR/HSS, and SMSC components) for unauthorized access, unexpected configuration changes, or anomalous routing of SMS and voice traffic tied to specific subscriber identities.
• Enterprises and individuals with high-value accounts should reduce reliance on SMS-delivered 2FA where possible. App-based authenticators, hardware security keys, and other phishing-resistant MFA methods do not depend on carrier-controlled delivery.
• Security teams supporting personnel who travel to or operate within the affected region should treat SMS and voice channels as potentially monitored and avoid sending sensitive codes or information over them.
• Threat intel and telecom security teams should track further disclosures from Enea for indicators, affected operator names, or technical detail that could sharpen detection and hunting once published.

Developing Intelligence

This is a new campaign disclosure without an associated CVE. Public technical detail is currently limited to Enea's initial reporting. We will continue to monitor for follow-up analysis and update this post as more information becomes available. Read the original report at The Hacker News.