SilentAir SS7 Attack: Inside the State-Level Hijack of Asian Mobile Operators

The most important message in Enea’s new threat report never showed up on a screen. It was a silent SMS, fired into a mobile network to answer one question: after the attacker falsified a subscriber’s location in the home network’s database, were that subscriber’s texts now arriving at the attacker? When the probe came back to the attacker’s own node instead of reaching the handset, the hijack was confirmed. The one-time passcodes that followed belonged to someone else.

On 11 November 2026, the Stockholm-based telecom security vendor Enea published the research behind this technique. It names the actor SilentAir and describes compromised signalling nodes inside operators in at least six Asian countries, used to intercept calls and messages belonging to selected subscribers, primarily in Taiwan. The Hacker News followed with a summary two days later. It notes that Enea assesses the actor as state-level with high confidence but ties it to China-nexus operations with only low confidence, and that for some targets two-factor authentication codes were seen arriving at attacker infrastructure immediately after a successful interception.

SilentAir is a story about the interconnect more than about a new malware family. The protocol tricks are well understood. What sets this actor apart from a decade of documented SS7 abuse is where it sits. Most signalling attacks originate from leased or spoofed addresses at the edge of the interconnect. By Enea’s account, SilentAir operates from equipment inside the operators themselves, injecting malicious SS7 and Diameter traffic into the IP Packet eXchange (IPX) from nodes the rest of the industry has every reason to trust. That changes the defensive problem completely, and it is the thread I follow through the rest of this report.

Why the IPX interconnect was never a security boundary

Mobile roaming runs on a private internetwork most subscribers never think about. The GPRS Roaming Exchange (GRX) originally carried packet-core traffic between operators. Around 2007 to 2008 it was absorbed into the broader IPX, which today carries SS7 over IP transports, Diameter for LTE roaming, SIP, and GTP for user data.

At the protocol level, an SS7 MAP message between two operators typically travels as TCAP over SCCP over M3UA over SCTP, usually on port 2905. Diameter rides SCTP or TCP on port 3868 through routing agents. GTP splits into a control plane on UDP 2123 and a user plane on UDP 2152. The addressing that makes all of this routable is partly public by design. Operators publish global titles, IP addresses and APNs in GSMA IR.21 documents so roaming partners can configure their networks, which also hands an adversary a map of legitimate signalling identities to imitate.

The GSMA baselines and where they fall short

The trust model underneath was exposed as fragile in 2014, when the first widely reported SS7 abuses showed that any party with interconnect access could query or redirect subscriber traffic. Later research confirmed the same class of weakness in Diameter. The industry answered with the GSMA’s FS.11 guidelines for SS7, FS.19 for Diameter and FS.20 for GTP. These sort interconnect messages into categories: messages that should never cross an operator boundary at all, messages that may only arrive from a network where the subscriber is plausibly roaming, and so on. Velocity and plausibility checks are attached to the sensitive cases.

Enea’s central warning is that in many operators’ thinking these baselines have quietly become a ceiling instead of a floor. SilentAir’s traffic came from global titles belonging to real, compromised operators, which is exactly the identity class category-based filtering is built to accept. More than 800 mobile operators are reachable through the IPX, so as Enea puts it, compromising one gives access to all.

How SilentAir hijacks SMS and 2FA codes by poisoning the HLR

The interception primitive is a lie about location. In SS7, a serving MSC/VLR announces a subscriber’s presence to the home location register (HLR) with a MAP UpdateLocation (opcode 2). The HLR replies by pushing the subscriber profile back in InsertSubscriberData (opcode 7), acknowledges the update, and cancels the subscriber’s record at the previous serving node.

SilentAir sent exactly this message, or its Diameter equivalent, the S6a Update-Location-Request/Answer pair (command code 316), from compromised nodes. The claim was that the attacker’s equipment was now serving the target handset. If the home network accepted it, the HLR’s record of where to deliver terminating traffic pointed at the attacker.

From a poisoned record to intercepted messages

Everything downstream follows from that corrupted record. When an SMSC needs to deliver a message, it issues SendRoutingInfoForSM (opcode 45) to the HLR and gets the serving node address back. With the record poisoned, that address is the SilentAir node, and the MT-ForwardSM (opcode 44) carrying the actual text lands on attacker infrastructure.

The same mechanism primes voice diversion, since terminating call routing asks the registered serving node for a roaming number. Enea published no evidence of completed voice interception, though, and neither Enea nor the press coverage claims any confirmed account takeover. What Enea did observe, for some targets, was 2FA codes arriving right after the moment of interception. That is about as clear a statement of intent as signalling telemetry allows.

Why LTE subscribers are still exposed

This still works against LTE subscribers. SMS in 4G commonly falls back over the SGs interface to the circuit-switched MSC/VLR, so a MAP-level hijack of the CS registration stays effective even when the data session is pure LTE.

Why SMS home routing does not fix a poisoned HLR

One defensive point is often misunderstood. SMS home routing is the GSMA-recommended arrangement in which external SRI-SM queries are answered by a home-network SMS router instead of exposing the real serving node. It hides addressing from outsiders. It does not cure a poisoned HLR, because the home router still runs its internal routing query against the corrupted record and forwards the MT-FSM to the attacker’s address. Home routing defeats address harvesting and leaves registration hijacking untouched. The control that matters here is the integrity of the UpdateLocation transaction itself and of the node asserting it.

What the attack mix says about the customer

The numbers point to an intelligence-service customer rather than a commercial surveillance vendor. Interception made up 18.30% of SilentAir’s observed attacks, against 2.07% for a typical surveillance company in Enea’s earlier research. Location tracking, the surveillance industry’s bread and butter, was just 0.22% for SilentAir against 30.90%. Information harvesting was 7.21% against 61.89%. The remaining 74.27%, mostly silent SMS, compares with 5.13%.

The harvesting that did occur used SRI-SM, RestoreData and SendAuthenticationInfo in SS7, and Authentication-Information-Requests in Diameter. The Diameter requests yielded authentication vectors that could support fake-base-station-assisted interception locally. Cell-ID retrieval used AnyTimeInterrogation and the Diameter Insert-Subscriber-Data-Request.

Silent SMS as a proof-of-interception channel

A silent SMS is a standards feature. Short Message Type 0, identified by TP-PID 0x40 in 3GPP TS 23.040, obliges the receiving device to acknowledge receipt while discarding the content without displaying or storing it. That is why such messages have long been used for presence and location checks.

SilentAir repurposed that acknowledgement as a return receipt for its own hijack. Enea’s flow diagrams show the two outcomes clearly. After a successful UpdateLocation, the attacker submits a silent SMS as MO-ForwardSM (opcode 46). The SMSC’s routing query resolves to the SilentAir node, the MT-FSM comes back to the attacker, and the interception is verified end to end. After a rejected or aborted update, the routing query resolves to the legitimate home-network path, shown as a GMSC in Enea’s diagram, and the probe reaches the real handset instead.

Why the probes carry spam-like text

The submission path is deliberately indirect. SilentAir never sends these probes straight to the target. It submits the MO-FSM to an interim operator’s SMSC, usually in Southeast Asia and sometimes in Taiwan, which accepts the message and forwards it onward. That outsources the retry and delivery machinery the attacker would otherwise have to build, and it obscures the true origin. The cost is that the message passes through security nodes that may block or alter it.

That cost produced one of the report’s more human details. The silent messages carry text: generic, spam-like motivational lines such as “Wishing you endless energy and wellness!” and “Strong body, calm mind, joyful heart!”, often in English that would not pass for a native speaker’s and occasionally in local languages. Enea’s explanation is that interim SMSCs sometimes strip the silent flag, which makes the message visible. A blank or machine-generated text would alarm the recipient, while obvious spam gets dismissed. The camouflage is social engineering aimed at the one failure mode the attackers could not fully control.

When the probes fire

Timing separates two uses. Daytime probes mostly target subscribers on other networks, such as Southeast Asian operators, and appear to test whether earlier UpdateLocation attacks succeeded. The far larger nighttime volume spikes around midnight on every night except Saturday into Sunday and concentrates on Taiwanese subscribers.

Enea does not confirm the purpose of the night traffic. It offers two plausible readings. One is a bulk re-validation that earlier diversions are still in place, since handsets are least likely to re-register to their true location overnight. The other is a connectivity check on the A-party number used to send the probes. Either way, the silent SMS traffic works as a quiet, scheduled audit of which subscribers the attacker still controls.

Spoofed address or compromised node? How Enea told the difference

The investigation hinged on a question that applies to any signalling threat: is the source address spoofed from outside, or is a node inside the network genuinely compromised?

Enea had a precedent in HiddenArt, a Russian-linked actor that mimicked legitimate global titles but showed incomplete control of them. It sometimes responded twice to its own transactions or switched to Russian addresses mid-sequence. SilentAir also reused GTs resembling legitimate elements, but it answered its own transactions correctly.

The anomaly appeared in transactions it did not initiate. After a malicious UpdateLocation, external network elements legitimately send follow-up messages to the registered serving address. Those arriving at infected networks were handled in three inconsistent ways: ignored, errored or aborted at the end, or correctly acknowledged, with occasional double responses as well. A purpose-built interception node would answer all of them correctly. The scatter suggested that only selected transactions were processed by something foreign, with the rest left to the underlying host.

That left the same two hypotheses as with HiddenArt: spoofing with copied responses, or an implanted process. Enea resolved it by observing network elements inside one operator both initiating and receiving the attack commands, behaving exactly like SilentAir sources elsewhere. The implanted arrangement also looked more stable than HiddenArt’s copying scheme, which had to fall back to Russian GTs to sustain long sequences.

Detection and blocking were hard at first because the people behind SilentAir understood mobile networks and signalling defences well. After containment, Enea recovered artifacts of unauthorised access but never obtained the binary itself, and that gap shapes every attribution statement in the report. Enea also states a blind spot plainly. Subscribers on the infected operators’ own networks may have been targeted too, but that traffic was not visible to its interconnect monitoring.

SilentAir targeting patterns and the China-nexus attribution

The targeting reads like tasking by people, not automation. Attacks arrived in bursts ranging from a single subscriber to several thousand over a month, separated by gaps of months or longer. In rare cases SilentAir nodes in different countries coordinated against high-value targets, which Enea reads as evidence of a single controller issuing tasking.

Taiwan was the primary focus. Targets also sat in a dozen or more additional countries and territories, mostly Southeast and East Asian networks, with selections at times in East Africa, Central Asia, the Middle East and Europe. Some targets were political and government VIPs in their own countries. Chinese networks and subscribers were conspicuous by their absence.

The clock is the other indicator. Plotted across target timezones, non-silent-SMS activity lines up with a UTC+8 working day: a 9 a.m. start, dips mid-morning and in the evening, residual activity in the early hours, essentially nothing on weekends, and pauses or reductions around Chinese holiday periods. Enea compares the two daily dips to Lumen’s analysis of Volt Typhoon activity and reads the pattern as evidence of human operators instead of scheduled tooling.

Combined with the state-level behaviour profile and the target set, this supports the low-confidence China-nexus assessment. Enea is careful to say the regional interest is not exclusive to Chinese actors, and that the possible Liminal Panda connection does not influence the assessment because it remains unproven. Even the name carries a small signal. “Silent” refers to the stealth and the silent SMS, and “Air” comes from an Old Irish word for “in front of”, associated with facing the rising sun and the root behind the Irish word for east.

SIGweaver and SCTPE: the malware capability gap

The malware question is where the report gets most interesting for defenders of signalling hosts.

SIGweaver, the SCTP kernel driver

Singapore’s IMDA published an advisory on 21 January 2026 describing SIGweaver. According to the advisory, CrowdStrike Intelligence identified it that same day and attributed it to Liminal Panda with moderate confidence.

SIGweaver is a 64-bit Linux character device driver that registers as /dev/sctpe and hooks the kernel’s SCTP send and receive functions, sctp_sendmsg and sctp_recvmsg. From its user-mode controller it accepts a target peer address and port plus pre-crafted signalling messages held in driver memory. It then waits for legitimate outbound traffic on existing SCTP associations and appends its own messages to those flows, so it creates no new connections to detect. It supports SS7/M3UA, injecting TCAP messages, and Diameter, and it targets core-network applications including NMS, HSS, VLR and SGSN.

Two modes are described. Standard injection correlates responses to injected requests by message identifier. A covert C2 mode applies when the driver sits on both ends of a signalling path and tunnels attacker communications inside ordinary signalling. When SIGweaver copies a response, it overwrites the original with meaningless content, so the legitimate stack sees an error and not evidence of interception.

IMDA maps the behaviour to rootkit (T1014), non-application-layer protocol (T1095) and transmitted data manipulation (T1565.002). It recommends auditing /dev for sctpe and watching for unauthorised SCTP-related kernel modules.

What Enea’s SCTPE reverse engineering reveals

Enea’s reverse engineering of the related binary it calls SCTPE adds the detail that decides the attribution question. The driver keeps a red-black tree of TCAP transaction IDs and Diameter End-to-End Identifiers for messages it generated. A lookup returns 0 only if the ID was cached and the response arrived within 5001 milliseconds. It returns -1 if the ID was never cached and -2 if it expired, and only a 0 is processed. Everything else is ignored and left to whatever legitimate SCTP client owns the association.

That design suits request/response harvesting and is useless for interception, because interception depends on receiving transactions the implant never initiated. Yet Enea observed SilentAir nodes handling and responding to uninitiated transactions. Some responses were attributable to the host’s legitimate clients, but others are believed to come from the SilentAir process itself.

The errored and aborted outcomes in the earlier telemetry fit the copy-and-corrupt behaviour IMDA describes. The correct acknowledgements of unsolicited transactions exceed the known binary’s capability. Add operational security that Enea rates far above Liminal Panda’s, and subtly different operating hours, and the honest conclusion is the one Enea draws: a possible but unconfirmed link. Shared access, cooperation, or two China-nexus actors in the same networks all remain live explanations.

Liminal Panda background

The Liminal Panda context is well documented. CrowdStrike’s November 2024 disclosure described an actor targeting telecoms since at least 2020, separated out of the earlier LightBasin cluster. It uses PingPong, CordScan and SIGTRANslator alongside public proxies, and emulates GSM protocols for C2. CrowdStrike assessed it as China-nexus with low confidence, citing indicators that include a Pinyin XOR key, wuxianpinggu507, and Belt and Road-aligned targeting. Palo Alto’s Unit 42 later assessed its CL-STA-0969 telecom intrusions as overlapping Liminal Panda with high confidence. Enea also cites Brandefence’s moderate-confidence assessment that some aspects of the group operate on behalf of a regional bureau of China’s MSS.

GTPDoor v3 (GTP-U-Door): the user-plane fallback

The second half of Enea’s report covers the access and exfiltration layer, and it updates a piece of malware history that began on 27 February 2024, when the researcher HaxRob published GTPDoor, a Linux implant for hosts adjacent to the GRX that hides C2 inside GTP-C.

How the original GTPDoor worked

The original mechanics explain the evolution. A raw socket captures UDP 2123 without any listening service. A GTP Echo Request “magic packet” authenticated with a 32-bit XOR key carries commands, and their output returns in Echo Responses. The default key is 135798642, a keyboard pattern of odd digits going up and even digits going down. The process overwrites its name to [syslogd]. A secondary TCP probe answers arbitrary packets with RST/ACK frames whose urgent pointer encodes the implant’s presence.

Host detection relied on raw sockets visible in lsof or netstat, a fake kernel thread whose parent is not kthreadd, and artifacts such as /var/run/daemon.pid and system.conf. IMDA issued its own GTPDoor advisory the same day.

Enea’s GTP firewall detections

Public detection of live GTP-C activity came only in July 2026, from POST Luxembourg. Enea now reveals it had been detecting and blocking GTPDoor and associated Liminal Panda activity through its GTP firewall at multiple customer operators since Q1 2026. That adds up to several hundred attempted covert C2 communications. Enea has direct evidence or strong indications of infection at 5 to 10 operators, and its intelligence suggests several dozen globally, weighted toward Asia, Africa and Latin America.

The observed command set is that of a patient occupier. Operators of the implant started and stopped exfiltration tunnels with a modified SGSNemu, relayed lateral-movement commands via EchoBackdoor, launched processes including SSH, health-checked the malware, and deleted files or timestomped to hide.

Exfiltration typically runs through a GTP-U tunnel from the infected operator back to a GGSN or other IPX-facing node in another infected operator. Half the observed tunnels lasted under 21 minutes and a few exceeded 24 hours. Creation frequency decayed from frequent early attempts to long gaps, which differs from the scheduled daily pattern CrowdStrike had described.

What GTPDoor v3 changes

The evolution is GTPDoor v3, which Enea also calls GTP-U-Door. A VirusTotal sample carries the same default XOR key and the ability to rekey. It moves the payload deep inside GTP-U T-PDUs with an inner IP packet and replaces the raw-socket receive path with libpcap, so the listener no longer appears in netstat or lsof. It also drops v2’s ACL feature.

Enea spells out why the user plane is a deliberate choice. GTP-U’s nested encapsulation complicates inspection, its volume on IPX links is orders of magnitude above GTP-C, and operators have historically invested less in securing it. It is also future-proofing, since GTP-C disappears in 5G while GTP-U carries forward. Enea believes v3 serves mainly as a backup when other channels, including SSH, are blocked.

Indicators of compromise

The published indicators for hunters are:

• GTPDoor v3: MD5 35f0d4d0c5519a2957338e448fce53bc (Enea’s report)
• SCTPE: MD5 da35d98c9a22e8ede93595d21fe7e63e (Enea’s report)
• SIGweaver: SHA256 8fbc7e7998dec1c18cbe8fbe2340038cd7768e5a946a92fc1a2712101622d2e5 (IMDA’s annex)

How to defend SS7, Diameter and GTP after the edge has fallen

Read together, Enea’s recommendations make a single argument: the edge is no longer a boundary an operator can defend alone.

Operators should deploy GTP-C and GTP-U firewalls and make them share state with SS7 and Diameter firewalls. The correlations that exposed this activity, signalling hijacks in one protocol and exfiltration tunnels in another, are invisible to any single-protocol sensor. The GSMA baselines should be treated as a starting point and the entire IPX, including DNS and ICMP, as untrusted. Detection logic, not necessarily firewalling, should extend to internal signalling interfaces, where tools like SIGTRANslator and CordScan relay C2 and perform discovery today.

Signalling security also has to merge with the operator’s wider IT security, since Liminal Panda moves between SSH, shared credentials and protocol abuse without regard for organisational charts. Enea adds a governance point that its investigations kept forcing into view. Outsourced, vendor-managed core networks make sensitive investigations materially harder, which makes it a digital sovereignty question as much as a security one.

Host-level checks for signalling servers

The practical checks follow from the malware analysis:

• Audit /dev for sctpe.
• Watch for unrecognised SCTP kernel modules.
• Inspect raw sockets and fake kernel threads.
• Verify iptables and SSH hygiene on interconnect-facing servers.

What SilentAir means for SMS two-factor authentication

The report offers no guidance for the people whose messages were read. The implication stands on its own anyway. An SMS one-time code is only as private as the signalling path that delivers it, and that path ends in databases an attacker can rewrite from inside a trusted operator.

Enea believes both actors’ footprints have been disrupted for now. It has notified affected operators and coordinated with POST Luxembourg. It does not claim every infected node is clean, and it never obtained the SilentAir binary. The technique is proven and the interconnect still runs on trust, which is what operators should be acting on this quarter.