SilentAir: A State-Level Cyber Threat Targeting Taiwan’s Telecom Sector
A newly identified threat actor, dubbed SilentAir, has been engaging in sophisticated cyber espionage by leveraging compromised mobile operators across Asia to intercept calls and messages. This disturbing activity has notably focused on Taiwanese subscribers. The cybersecurity firm Enea has been monitoring this entity since the early part of 2025, revealing alarming insights into its operations in a recent research report published on November 11.
Enea, a reputable firm specializing in telecommunications software and cybersecurity solutions, provided a thorough analysis in its findings. The report not only outlines the activities of SilentAir but also touches on another malicious group known as Liminal Panda. This organization has been implicated in various attacks against mobile operators, highlighting a landscape rife with threats to telecommunications security.
While Enea speculates a potential connection between SilentAir and Liminal Panda, it maintains a stance of caution, stating that such associations remain unproven at this time. The intent of exploring the relationship between the two groups illustrates the complexity of the ongoing cybersecurity landscape and the interconnected nature of various state-sponsored activities.
The Focus on Taiwanese Subscribers
Enea is highly confident in its assessment that SilentAir operates at a state level. Utilizing advanced techniques such as Signaling System No. 7 (SS7) and Diameter attacks, this actor has launched operations from hijacked equipment spread across at least six Asian countries. The reach of these attacks has extended to targets in more than a dozen countries and territories, emphasizing the scale and sophistication of its operations.
The attacks have been characterized by distinct waves, where the number of targeted subscribers can range from a mere handful to several thousand within a single month. Periods of intense activity alternate with extended lulls, during which no discernible attacks occur. Enea’s analysis points out that interception of communications accounted for 18.30% of SilentAir’s overall activity, in stark contrast with the mere 2.07% attributed to surveillance companies typically engaged in signaling attacks.
A particularly concerning element of the attacks is the timing of the incidents. In some cases, two-factor authentication (2FA) codes were received only moments after interception commenced, suggesting a clear motive to further breach the victims’ accounts. The majority of SilentAir’s activities, meanwhile, involved sending silent SMS—messages that never appear on the recipients’ devices—primarily targeting users in Taiwan during the late-night hours.
Enea has tentatively linked SilentAir to Chinese state-sponsored operations, citing several points of evidence to support this theory. The group’s concentration on Taiwanese targets, the absence of attacks against entities within China, and operational patterns synchronized with China’s time zone all raise suspicions. Moreover, the activity patterns exhibit distinctive lulls coinciding with Chinese holidays, possibly signaling a strategic approach to avoid detection during periods of heightened scrutiny. Notably, some of the intended targets included high-profile political and governmental figures, underscoring the seriousness of this threat.
The Liminal Panda Connection and GTPDoor
In addition to detailing SilentAir’s activities, Enea’s report sheds light on Liminal Panda, which has expanded its operations through a backdoor known as GTPDoor. This malware, designed to conceal command-and-control (C2) traffic within the GPRS Tunneling Protocol (GTP), has been detected by Enea’s firewalls as early as 2026. The cybersecurity firm reported successfully blocking numerous attempts at establishing C2 exchanges via GTPDoor, which indicates the proactive measures being taken to defend against such threats.
Enea’s findings suggest at least five to ten operators may have been infected by Liminal Panda, with indications that the true number could reach several dozen across regions including Asia, Africa, and Latin America. Moreover, a new variant of GTPDoor appears to have been developed, utilizing the GTP-U protocol, which carries significantly heavier user data traffic. This new version, described by Enea as a fallback mechanism, has the potential to evade detection, posing an ongoing risk as it extends into 5G networks.
Cybersecurity analysts, including experts from CrowdStrike, have also noted the possible China-nexus of Liminal Panda’s operations. This has prompted Enea to assist its customers in uprooting Liminal Panda from their networks, in addition to issuing alerts to operators suspected of hosting SilentAir’s sources.
While both SilentAir and Liminal Panda have faced temporary setbacks, Enea cautions that conditions conducive to their return remain intact. The ever-evolving nature of cyber threats, particularly those tied to state-sponsored actors, necessitates ongoing vigilance and proactive engagement in defense strategies. The revelations underscore a pressing need for enhanced cybersecurity measures within the telecommunications sector to protect against such advanced and persistent threats.