Threat actors · Briefing
SilentAir used compromised Asian telecom equipment to intercept SMS authentication codes
Enea reports disruption of the activity, but equipment cleanup remains unclear. Defenders should examine how telecom signaling trust can affect account security.
Kinwilder research desk · · AI-assisted analysis
Briefing · 14 November 2026
What is established
Enea says SilentAir used compromised mobile-operator equipment across at least six Asian countries, principally targeting Taiwanese subscribers. Infosecurity Magazine’s report, published 12 November 2026, dates Enea’s research to 11 November 2026 and its monitoring to early 2025.
The Hacker News, published 13 November 2026, describes false serving-network updates that diverted communications. Enea observed intercepted authentication codes after some diversions. The activity was reportedly disrupted; equipment cleanup remains unclear.
Defender implication: an authentication process can depend on infrastructure beyond the account owner’s device. Reviewing that dependency deserves attention even where local endpoint monitoring shows nothing suspicious.
Who is behind it
Enea names the activity SilentAir, assesses a state-level actor with high confidence, and associates it with China with low confidence. A connection to Liminal Panda remains unproven. Infosecurity Magazine reports those assessments.
Analysis: these assessments do not establish operator location or justify treating the two activity clusters as interchangeable. Response teams should preserve those distinctions in intelligence records and detection labels.
Our analysis
Analysis: the critical boundary is between a network’s assertion about where a subscriber can be reached and its authority to redirect that subscriber’s communications. The authorization invariant is straightforward: a routing change should be accepted only when the sender is entitled to make that change for that subscriber in that context.
From an attacker’s perspective, controlling infrastructure that another network already trusts could make a false assertion appear routine. From a defender’s perspective, recognizing a legitimate network address is therefore insufficient evidence that an individual request is legitimate. The useful question is whether identity, permission and subscriber context agree.
Potential exposure should be assessed through these trust relationships, rather than inferred solely from geography. Operators should ask which partners can influence subscriber routing and how those privileges are constrained. Enterprise identity teams should ask which sensitive accounts still depend on text delivery for authentication or recovery. These are assessment priorities, not evidence of additional victims.
Possible AI applications—analysis: attackers could use AI to interpret unfamiliar protocol documentation. Defenders could use it to summarize signaling anomalies and correlate timelines, with analysts checking the underlying records. Neither supplied report establishes AI use in this activity.
Defensive actions
Enea recommends treating IPX as untrusted, connecting signaling defenses with IT security, monitoring internal signaling, and coordinating GTP-C/GTP-U firewalls with SS7/Diameter controls, according to The Hacker News.
Our recommended priorities:
- Establish ownership and visibility. Assign telecom security and incident-response owners to review routing-change permissions. Identify where signaling decisions, administrative access and equipment changes are logged. Record visibility gaps explicitly.
- Hunt across boundaries. Correlate unusual subscriber-routing changes with equipment access records and available identity-provider authentication logs. Investigate inconsistencies between the claimed serving network and expected subscriber context. A correlation is an investigative lead, not proof of compromise.
- Protect consequential accounts. Inventory SMS-dependent authentication and recovery paths. Prioritize stronger authentication for privileged and sensitive accounts, while checking that recovery procedures do not retain the same dependency.
- Verify enforcement safely. In an authorized lab or configuration review, select a synthetic subscriber and document which network identities may change its routing. Check that an unauthorized identity is rejected and logged, and that the alert reaches a named responder. Use no real subscriber traffic.
For suspected equipment compromise, preserve relevant evidence and coordinate containment with service owners. Blocking suspicious traffic alone should not be treated as proof that the underlying access has been removed.
Key concepts
- Signaling: network control messages; SS7 and Diameter support mobile routing and roaming. Source
- Trust boundary: the point where one system decides whether to accept another system’s assertion.
- Authorization invariant: a rule that must remain true before a consequential action is permitted.
- Authentication versus delivery: receiving a code demonstrates access to its delivery channel; defenders should assess whether that provides sufficient assurance for the account’s risk.
Limits
Both supplied publications relay Enea’s findings; they are not independent technical corroboration. The Hacker News identifies no operators or targets and establishes neither account takeover nor comparable evidence of voice interception. No initial compromise mechanism, affected product versions or fixed release is established in this packet. Kinwilder did not reproduce the activity.
Groups in this story: LIMINAL PANDA
Kinwilder briefing: AI-written analysis of public reporting, checked in a separate AI review against the linked sources. No human expert review or independent reproduction is implied.