As reported by The Hacker News, Enea has disclosed a state-level espionage actor dubbed SilentAir that compromised telecom infrastructure across at least six Asian countries to intercept SMS messages and voice traffic — primarily targeting users in Taiwan. The group's abuse of SS7 and Diameter signaling protocols to divert traffic and capture two-factor authentication codes represents one of the most aggressive signaling-based interception campaigns observed to date, with interception accounting for 18.3% of its observed attacks — nearly nine times the rate of typical surveillance-for-hire operators.
Why This Matters Beyond Telecom
The most alarming aspect of SilentAir's campaign isn't the espionage itself — it's the interception of 2FA codes immediately following location-update spoofing. This is not passive surveillance; it is active preparation for account takeover. When an attacker can redirect SMS-based authentication tokens at the network layer, no amount of user awareness training or endpoint hardening will help. The authentication channel itself is compromised before the code ever reaches the victim's device.
This should be a watershed moment for every security leader still relying on SMS-based MFA for privileged accounts. The attack surface isn't theoretical — it's being actively exploited by state actors against government and political VIPs. If your organization's executives, administrators, or key personnel travel to or communicate with parties in the Indo-Pacific region, you should assume SMS 2FA is a broken control for those individuals.
The SS7/Diameter Problem Isn't New — But the Scale Is
SS7 vulnerabilities have been documented for over a decade. The protocol was designed in an era when telecom operators implicitly trusted each other, and that trust model has never been adequately updated. SilentAir's innovation is operational, not technical: by compromising equipment inside mobile operators and launching attacks from the IPX interconnect network, the group gained legitimate-looking signaling access that bypasses many perimeter defenses designed to filter traffic from untrusted sources.
The shared trust model of the IPX network means a single compromised operator can become a launchpad for attacks against subscribers across dozens of partner networks. SilentAir demonstrated this by coordinating attacks across multiple compromised operators simultaneously.
Who Is at Risk
Broader Implications
SilentAir's burst pattern — attacks clustered over a month, followed by months of silence — suggests a disciplined operator managing operational security and resource allocation. The coordination of compromised equipment across multiple countries against single targets indicates centralized command and control, not a fragmented set of compromised networks acting independently. Enea's low-confidence attribution to China is notable; the TTPs align with regional state interests, but the false-flag potential of telecom-layer attacks makes attribution inherently difficult.
The fact that Enea observed attacks from operators that "would not normally send attacks" is a critical detection heuristic. Defenders in telecom environments should be establishing baselines for expected signaling traffic patterns and alerting on anomalous source networks — a control that appears to have been absent or insufficient at the compromised operators.
Shield53 Recommendations
For Enterprise Security Teams
- Eliminate SMS-based MFA immediately for all privileged, executive, and high-risk accounts. Replace with FIDO2/WebAuthn hardware keys or passkeys, or at minimum TOTP authenticator apps.
- Audit your identity provider's MFA enrollment — identify every account still using SMS as a primary or fallback factor and prioritize migration.
- Implement number-only SIM swap protection with your mobile carriers where available, and brief traveling executives on the risks of roaming through foreign networks.
- Add transaction-level anomaly detection — if a user's 2FA challenge originates from a network path inconsistent with their known location or device, trigger step-up authentication via an out-of-band channel.
For Telecom Operators
- Deploy SS7/Diameter firewalls with strict filtering of UpdateLocation and related signaling messages from networks that have no legitimate reason to serve your subscribers.
- Establish inter-operator signaling baselines and alert on traffic from sources that deviate from historical norms — Enea's detection method.
- Audit all IPX-connected equipment for compromise indicators, particularly edge nodes and signaling gateways that handle roaming traffic.
- Implement 5G security architecture (3GPP TS 33.501) controls including mutual authentication and home network control of roaming decisions, which reduce exposure to legacy SS7 attacks.
For CISOs and Risk Leaders
- Reclassify SMS 2FA as a deprecated control in your risk register. It should not count toward strong authentication requirements for any account with elevated access.
- Brief your board — this is not a hypothetical. State actors are actively intercepting authentication codes at the network layer, and the technology to do so is commoditizing among surveillance vendors.
- Review travel security policies for personnel visiting affected regions. Consider issuing burner devices and separate authentication credentials for high-risk travel.
The SilentAir campaign is a reminder that the weakest link in many authentication chains isn't the user's password — it's the decades-old trust model underpinning global telecom infrastructure. Until SS7 and Diameter are meaningfully replaced or wrapped in modern cryptographic controls, the protocol layer will remain a soft target for well-resourced adversaries. Organizations that continue treating SMS as a valid second factor are accepting a risk that is no longer theoretical.
