Skip to content
SilentAir and Liminal Panda Target Asian Telcos for Interception

SilentAir and Liminal Panda Target Asian Telcos for Interception

First seen 12 Nov 2026, 15:50 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 15:51 UTC
  • •SilentAir and Liminal Panda are linked to state-level cyber operations targeting Asian telcos.
  • •Attacks involve SS7 and Diameter protocols, intercepting calls and 2FA codes.
  • •Enea reports potential infections in multiple operators, with ongoing risks.

Enea's research identifies two threat actors, SilentAir and Liminal Panda, involved in sophisticated attacks against telecommunications operators in Asia, particularly targeting Taiwanese users. SilentAir has been linked to state-level operations, employing SS7 and Diameter attacks to intercept calls and messages, including two-factor authentication codes. The attacks have affected at least six Asian countries, with targets including political and government VIPs. Liminal Panda has been detected attempting command-and-control communications across multiple operators, with evidence of infection in 5-10 operators and potential impacts on dozens more. Both groups have been temporarily disrupted, but the threat remains as conditions for their return persist.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 4h ago How this analysis works

Timeline

2026-11-11
Enea publishes research on SilentAir and Liminal Panda
Enea's report details the activities of SilentAir and Liminal Panda, highlighting their targeting of telecommunications networks in Asia.
Infosecurity-Magazine
2026-11-12
Enea updates findings on mobile network threats
Enea adds a Key Takeaways section to summarize the evolution of Liminal Panda and SilentAir's attacks on mobile networks.
Enea

More articles in this cluster (3)

Following this threat?

Track Liminal Panda, GTPDoor and Enea in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

Who is affected by these attacks?
Telecommunications operators in at least six Asian countries, particularly targeting Taiwanese users and political VIPs.
What methods are used in these attacks?
The attackers utilize SS7 and Diameter protocols to intercept calls and messages, including two-factor authentication codes.
What should telecom operators do to protect themselves?
Operators should enhance monitoring of their signaling networks and implement security measures to detect and mitigate SS7 and Diameter attacks.