Telecom infrastructure has long been a prized target for nation-state espionage, and a newly documented campaign shows why. A previously unknown threat actor tracked as SilentAir has been operating inside mobile operator networks across Asia, using compromised equipment to intercept the calls and text messages of targeted individuals—most of them in Taiwan. The findings were published this week by Enea, a Stockholm-based telecom and cybersecurity software firm, and were first reported by The Hacker News.

What Enea Found

Enea's investigation traced the group's attack infrastructure to at least six Asian countries, indicating a distributed foothold rather than a single compromised operator. The firm assessed with high confidence that SilentAir is a state-level actor, a judgment that places the campaign in the category of government-backed espionage rather than financially motivated cybercrime.

The operational focus is narrow and deliberate: selected individuals, predominantly Taiwanese, whose communications are intercepted at the network layer. By positioning itself inside carrier infrastructure, the group can observe traffic that would normally be protected by the inherent trust users place in their mobile provider.

Why Telecom Interception Is So Dangerous

The significance of this campaign lies less in the novelty of the technique than in the position from which it is executed. Mobile networks are the backbone of modern authentication. SMS one-time passcodes remain one of the most widely deployed second factors for banking, email, and enterprise services, despite years of industry warnings about their weaknesses.

An adversary operating inside a carrier's core network does not need to phish a victim or trick them into installing malware. It can simply observe the messages as they transit the operator's systems. That capability undermines SMS-based two-factor authentication entirely and can also expose voice communications, location-adjacent metadata, and the identities of contacts—intelligence of obvious value to a state sponsor.

This is also why attacks of this kind are difficult to detect. From the subscriber's perspective, nothing appears unusual: the call connects, the code arrives, the login succeeds. Anomalies may only surface through carrier-side traffic analysis, which is precisely the domain Enea occupies.

A Broader Pattern of Telecom Espionage

SilentAir is the latest in a series of campaigns demonstrating that telecommunications operators are a persistent strategic target. Over the past decade, multiple suspected state-linked intrusions into carrier networks have been disclosed, ranging from exploitation of signaling protocols such as SS7 and Diameter to compromises of roaming infrastructure and lawful-intercept systems. In several documented cases, attackers have abused the very tooling carriers use for authorized surveillance.

The concentration of SilentAir's activity in Asia, and its focus on Taiwanese users, suggests a geopolitical dimension consistent with regional intelligence priorities. Enea's attribution stops short of naming a sponsor, and readers should treat the state-actor assessment as an analytic judgment rather than a public attribution.

Defensive Takeaways

For defenders, the case reinforces several practical lessons:

  • Reduce reliance on SMS 2FA. Organizations should migrate high-value accounts to phishing-resistant authentication such as FIDO2 security keys or passkeys, which are not exposed by network-level interception.
  • Treat carriers as part of the threat model. Enterprises with regional operations should assess whether employees in affected geographies depend on SMS-based verification for critical systems.
  • Monitor for signaling anomalies. Operators and regulators should scrutinize roaming, interconnect, and intercept-system activity for unauthorized access patterns.
  • Assume communications may be observed. High-risk individuals should adopt end-to-end encrypted messaging and avoid discussing sensitive matters over conventional voice and SMS channels.

What Remains Unknown

The public reporting leaves important questions open. Enea has not disclosed which specific operators were compromised, how long the intrusion persisted, or how many individuals were targeted—details that are likely withheld to protect ongoing remediation and intelligence sensitivities. Whether the group retains access to any of the affected networks is likewise unclear.

The SilentAir disclosure is a reminder that the security of mobile communications depends on infrastructure most users never see and cannot audit. When that infrastructure is compromised by a capable state actor, the consequences ripple outward to every authentication flow and every conversation that passes through it. Organizations that still treat SMS as a trustworthy channel should use this report as a prompt to revisit that assumption.