Enea says a new actor, SilentAir, intercepts calls and SMS through compromised mobile operator nodes

Enea dates SilentAir to early 2025, 590 to 679 days before its report (derived)

Enea, a telecom software and security company, published a blog report on 11 November 2026 (11:13 UTC in the page's own data) and added a Key Takeaways section on 12 November. It says it has tracked unusual signalling attacks from some Asian mobile operators "since early 2025", and that follow up analysis found "suspicious activity from even before that". Reading "early 2025" as any day from 1 January to 31 March 2025 (this site's reading of a loose phrase), the gap to the 11 November 2026 publication is 590 to 679 days (derived): 31 March 2025 to 31 March 2026 is 365 days, plus 225 days to 11 November 2026, is 590; 1 January 2025 to 1 January 2026 is 365 days, plus 314 days, is 679.

That span is when Enea says it began watching. It is not a period of continuous interception: Enea calls the attacks "sporadic, stealthy and targeted" and says there may be "gaps of activity of up to several months or even longer". The earlier "suspicious activity" is not described as interception. The page names no operator that hosted a compromised node, no victim, and no subscriber total. It does not say how the nodes were compromised: Enea says it was "unable to successfully analyse the hypothetical SilentAir binary".

Enea sells signalling security to mobile operators (its site menu lists an Adaptive Signaling Firewall, a Signaling Intelligence Layer and IPX Threat Defense), and the report's observations come from Enea's own view of signalling traffic and its firewall service at customer operators, so every figure below is Enea's view, not an industry census.

Sources: Enea's report is the primary; SecurityWeek's article (13 November 2026, 12:20 UTC in its page data) is a secondary that rewords parts of it, and the section on where they differ says where. Both pages were read as saved at about 17:25 UTC on 13 November 2026. Enea says it will update the blog if its assessment of a link between SilentAir and LIMINAL PANDA changes, so everything here is as of that read.

How Enea says the interception works, in its order

Enea says SilentAir works by "generating Diameter and SS7 protocol signalling attacks that it injects into the IPX interface", the interconnect network operators use for roaming, messaging, voice and data. The traffic leaves "compromised network nodes in infected operators", aimed at "specific subscribers of interest worldwide". SS7 is the main protocol; Diameter is used sometimes.

How does Enea know the nodes are inside the operators rather than someone spoofing a source? It first weighed both explanations, having found spoofing with an earlier actor it calls HiddenArt (which it says it does not link to SilentAir). Then, in one investigation, "During our investigation, we were later able to observe network elements within a mobile operator both initiate and receive the signalling attack commands". That is one operator. For the rest, Enea's wording is "multiple SilentAir-related suspicious SS7 or Diameter network elements in mobile operators in at least 6 different Asian countries", "with others suspected but not confirmed". Enea also describes a behaviour it found odd: transactions the node did not start arrived at it, and depending on the infected network they were ignored, aborted or acknowledged.

The interception step is a location change. Enea says the attacker used "SS7 UpdateLocations and Diameter Update-Location-Requests to change the location of a targeted mobile subscriber", after which "Once the location is changed subsequent SMS and voice calls of interest would be intercepted". Enea also says silent SMS messages are used, "very large-scale usage of a special form of text message called silent SMS": messages that, in Enea's words, do not display or alert on the handset. In the daytime, mostly toward subscribers on other networks, Enea reads them as a test of whether an earlier location change worked. At night, mostly toward Taiwanese subscribers, "The purpose here is not confirmed". Enea says the messages are submitted through an interim operator's message centre, which hides their true origin.

The follow on step is the one the headline version of this story tends to overstate. Enea says "we observed 2FA codes being received directly after the moment of interception for some targets", and its Key Takeaways read this as "suggesting attempts to access other accounts". That is codes seen arriving. The page does not say that any account was opened, taken over or even tried.

Zoom

The attack mix: interception is 18.30% of SilentAir activity against 2.07% for surveillance companies

Enea prints one table of what SilentAir's signalling consisted of, beside what it says it normally sees from surveillance companies, "who account for the overwhelming majority of attacks on signalling interfaces". The comparison column comes from Enea's earlier research, which this page does not reprint.

The SilentAir column adds to 100.00% and the comparison column to 99.99% (derived; rounding), so each is a whole distribution. Enea ties the large "other" share to silent SMS: "the high prevalence of "other" activity by the SilentAir attacker, specifically the use of silent SMS". Not stated: what is being counted (messages, transactions, subscribers or sources), over what period, or how many events lie behind the percentages.

One caution from this site, labelled as inference. Enea reasons that this mix points to a state-level actor, and defines "state-level" as a label chosen "based on activity, targeting and objectives". A label partly defined by the behaviour cannot also be independent proof of it, so the table shows that SilentAir looks unlike the surveillance companies Enea has measured, which is a narrower claim than the label.

Attribution as Enea states it: high confidence for the type, low confidence for China-nexus

Enea states two confidence levels, and they answer different questions. "We assess with high confidence that we have observed a new state-level actor". "we assess with low confidence that SilentAir's activity aligns with China-nexus cyber operations". "State-level" is Enea's term, defined in its footnote "to differentiate specific signalling threat actors from criminal groups or commercial surveillance companies". The high confidence is therefore about the category. It names no government. The low confidence is about alignment with "China-nexus" operations, which is Enea's wording and the only country level claim about SilentAir on the page.

Zoom

Two things in that table are easy to lose in a headline. First, Enea itself says the regional interest is shared by other groups, and that what makes the pattern distinctive is the Taiwan focus. Second, the strongest sentence on the page, high confidence, is about what kind of actor this is, not who runs it.

SilentAir and LIMINAL PANDA: "possible, but unconfirmed"

LIMINAL PANDA is an actor others reported earlier; Enea describes it as publicly reported and China-nexus, and notes that CrowdStrike assessed in November 2024, with low confidence, that its activity "aligns with China-nexus cyber operations". Enea's verdict on a link to SilentAir is "Overall, this points to a possible, but unconfirmed link of the SilentAir actor with LIMINAL PANDA", and "we do not directly associate the two at this time". The page gives evidence in both directions.

Enea lists three possibilities and picks none: that different groups "may share access to a compromised operator once obtained or co-operate in carrying out separate operations", that the operators were compromised by two China-nexus actors at the same time, or that SilentAir is someone else. Because Enea could not analyse the SilentAir binary, the comparison with SCTPE rests on observed signalling behaviour only.

The scale figures are Enea's estimates, from Enea's own view

The report has two halves. The SilentAir half rests on signalling Enea observed arriving from some Asian operators. The LIMINAL PANDA half rests on its GTP firewall at customer operators: Enea says it began to detect GTPDoor and other LIMINAL PANDA activity on the GTP-C interface "in multiple customer mobile operators from Q1 2026 onwards", and blocked it. It also reports a new GTPDoor version that uses GTP-U, which it calls GTPDoor version 3. POST Luxembourg reported detecting GTPDoor activity in July 2026, and Enea says it co-ordinated with POST's Cyberforce team. The page does not say whether POST, or any operator it names, was infected.

Two statements on status. Enea says it worked with customers to remove LIMINAL PANDA activity, contacted other infected operators it detected, and informed the SilentAir operators of malicious signalling sources in their networks. It then says "While the LIMINAL PANDA & SilentAir groups themselves have been disrupted for now", the conditions remain for a return. What is happening on any network today is not stated, and a block at Enea's firewall is not the same as a clean-up of a compromised node.

Where SecurityWeek and Enea differ

SecurityWeek's phrases "assesses with high confidence", "silent SMS" and the political and government targets are Enea's own wording or close to it. The differences are in firmness and in what was left out. None is resolved here: the article follows Enea's page.

Labels that carry weight: state-level, blocked, recommended

Three labels on the page do more work than the evidence printed beside them. "State-level" names a category defined by behaviour and says nothing of who. "Blocked" describes what Enea's firewall did at its customers; Enea says separately that it worked with customers to remove activity and informed other operators, which is a different job. And "industry recommendations" are, on Enea's own account, not a control: "there is a danger that these recommendations come to be regarded as the endpoint for signalling security, rather than the start", leaving an operator with "the illusion they are protected, when they are not". That is Enea's argument for products beyond the baseline, and it is also a fair test for any operator's own claim of coverage.

What Enea states, and what it does not

What to do, in order

Enea's recommendations are addressed to mobile operators. The page gives no advice to subscribers or enterprises, so those steps are this site's suggestions and are marked as such. Each item says whose it is.

What Enea prints that a hunt team can use

The page text prints real artifacts, and they are set out below as Enea gives them: two file hashes, the names of the signalling messages SilentAir used, the command types GTPDoor carried, behaviours of the GTPDoor version 3 binary, a few properties of the SCTPE trojan, and five example silent SMS texts. It prints no domain, no IP address, no global title and no port number in its text. Its ten figures, including a port capture (Figure 5), a packet structure (Figure 4) and a decompiled code capture (Figure 9), are images on Enea's page which this site did not fetch, so nothing from them is used here.

The first block holds the only two indicators Enea lists, as the two rows of its IOC table. They are MD5 hashes, a weak hash function, and Enea prints no SHA 256. A defender searches file inventories, endpoint telemetry and backups on Linux hosts, especially IPX facing nodes, for these values. Enea says it found a GTPDoor version 3 sample on a public scanning service; this site did not visit it.

GTPDoor v3  MD5 35f0d4d0c5519a2957338e448fce53bc
SCTPE       MD5 da35d98c9a22e8ede93595d21fe7e63e

The second block lists the signalling message names Enea says SilentAir used, grouped as Enea groups them. A defender can compare per sender rates of these message types arriving from foreign operators against a baseline. That use is this site's suggestion; Enea does not publish thresholds. Update location is the one Enea ties to interception.

Information harvesting
  SS7:      SRI-SM, RestoreData, SendAuthenticationInfo
  Diameter: AIRs (AuthenticationInformationRequests)
Location tracking
  SS7:      AnyTimeInterrogation
  Diameter: Insert-Subscriber-Data-Request
Interception
  SS7:      UpdateLocations
  Diameter: Update-Location-Requests
Silent SMS path (Enea's simplified description)
  MO-FSM submitted to an interim operator's SMSC, then MT-FSM delivery

The third block holds the command types Enea says GTPDoor carried, copied exactly. A defender uses them as a hunt list on hosts at the IPX edge and inside the core: tunnel start and stop activity, SSH started by an unexpected process, process and host health checks, and attempts to delete files or alter timestamps.

Starting/stopping communication & exfiltration tunnels (using modified versions of tools like SGSNemu)
Encapsulation of commands using other tools for lateral movement through the infected operator (using malware like EchoBackdoor)
Initiation of other processes, including SSH commands
Malware process health checks, general host environment process checks
Hiding of activity, including attempts to delete files and directories, timestomping etc
And other activity consistent with a threat actor seeking to preserve and expand their presence in infected networks.

The fourth block holds what Enea says about the new GTPDoor binary and the protocol use. Enea says the libpcap listener does not appear in the two host tools it names, which it describes as a host based detection method from the earlier public analysis of version 1 and 2, so a host check that relies on them would miss it. A defender therefore also inspects GTP-U at the IPX edge and packet capture activity on hosts.

GTPDoor is a Unix-based remote-access implant that uses the GTP-C protocol for covert command & control (C2) communications.
The default XOR key is the same as GTPDoor v1 and v2, with also the same ability to change the key.
The other main change is the adoption of libpcap for packet capture, replacing the raw socket receive path in v1/v2.
the libpcap listener does not appear in 'netstat' or 'lsof'
GTPDoor v3 doesn't have an ACL feature like GTPDoor v2.
LIMINAL PANDA would normally use Echo Requests for GTP-C, and T-PDUs with an inner IP payload for GTP-U

The fifth block holds what Enea says about SCTPE, the trojan it compares with SilentAir's behaviour. Enea could not analyse a SilentAir binary, so this is a comparison, not an identification.

a kernel-level software directly designed to send and receive SS7 and Diameter traffic
Once the traffic has been injected it has a set window (5 seconds) to receive back data responses
Any other transactions received are ignored and not processed

The last block holds the five example texts Enea prints as carried by SilentAir's silent SMS. Enea says the texts are spam like and in English or local languages. They are generic and could appear in legitimate traffic, so a defender uses them only as one weak clue in the message centre logs, combined with the silent flag and an unusual submitting source.

Wishing you endless energy and wellness!
Stay healthy, stay happy, always shine!
Strong body, calm mind, joyful heart!
Health as steady as mountains ahead!
Fresh air, bright smiles, vibrant life!

The question the report leaves open

Enea names no operator, no victim and no subscriber count, and says it informed the operators of the malicious sources after finding them: if an operator learns of a node inside its own network only when a signalling vendor or a partner tells it, how would one of its subscribers ever learn that their calls and SMS codes had passed through it?

Key facts