Back Infosecurity-Magazine

Hacked Asian Telcos Used to Intercept Taiwanese Calls and Texts

Infosecurity-Magazine • November 12, 2026

Enea, a firm providing software for telecommunications and cybersecurity, named the actor SilentAir in its November 11 research , which also covers Liminal Panda , a group that has attacked mobile operators.

The company said it saw a possible but unproven connection between the two groups.

Enea is highly confident that SilentAir operated at state level. The actor launched Signaling System No. 7 (SS7) and Diameter attacks from hijacked equipment in operators across at least six Asian countries, hitting targets in a dozen more countries and territories.

For some targets, two-factor authentication (2FA) codes arrived moments after interception began, which Enea said showed an aim of breaking into their other accounts. Most of its other activity was silent SMS, texts that never show on the phone, sent largely to Taiwanese users around midnight.

Enea linked SilentAir to China-nexus operations with low confidence, citing the Taiwan focus, the lack of Chinese targets, working hours matching China's time zone and lulls over Chinese holidays. Some targets were political and government VIPs.

Liminal Panda Expands GTPDoor

Enea said its firewalls spotted and blocked GTPDoor and other Liminal Panda activity at several customer operators from early 2026, detecting several hundred attempted command-and-control (C2) exchanges.

GTPDoor, a Unix backdoor, hides its C2 traffic in the GPRS Tunneling Protocol (GTP), which carries roaming data.

Enea said it had seen at least five to 10 operators infected by Liminal Panda, directly or through strong indications, and believed the true figure might be several dozen, concentrated in Asia, Africa and Latin America.

It also found a new GTPDoor version that rode on GTP-U, the part of the protocol carrying user data. That traffic is far heavier and, according to Enea, less closely watched, and unlike the control side it carries over into 5G. Enea believed the new version mostly served as a fallback.

CrowdStrike linked Liminal Panda to China-nexus operations in November 2024, also with low confidence.

Enea said it helped customers clear out Liminal Panda and alerted operators hosting SilentAir sources. It said both groups had been set back for now, but warned the conditions remained for them, or others, to return.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SilentAir and Liminal Panda Target Asian Telcos for Interception Enea's research identifies two threat actors, SilentAir and Liminal Panda, involved in sophisticated attacks against telecommunications operators in Asia, particularly targeting Taiwanese users. SilentAir has been linked to state-level operations, employing SS7 and Diameter attacks to intercept calls and messages, including two-factor authentication codes. The attacks have affected at least six Asian countries, with targets including political and government VIPs. Liminal Panda has been detected attempting command-and-control communications across multiple operators, with evidence of infection in 5-10 operators and potential impacts on dozens more. Both groups have been temporarily disrupted, but the threat remains as conditions for their return persist. 1 sources 70

Extracted Entities

Hacked Asian Telcos Used to Intercept Taiwanese Calls and Texts

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)