Your Texts Were Diverted. Your 2FA Codes Went With Them.

Your phone never left your pocket. Your messages did. A newly identified spying group has been hijacking the signaling that routes calls and texts between mobile networks — and in some cases, it watched two-factor authentication codes arrive the moment a victim’s messages were diverted.

The group is called SilentAir, named this week by Stockholm telecom security firm Enea. Enea assesses with high confidence that it is a state-level actor, targeting subscribers in Taiwan through hacked equipment inside mobile operators in at least six Asian countries.

The network lied about where your phone was

Mobile operators route calls and texts with signaling protocols called SS7 and Diameter. When you roam, your home network learns which tower serves you through location messages exchanged over a shared inter-carrier network called the IPX — a system built on trust between operators.

SilentAir abused exactly that trust. From compromised equipment inside participating networks, the group sent the target’s home network an UpdateLocation message claiming the hacked equipment now served the target’s phone. If the home network accepted the claim, the victim’s calls and texts were diverted to the attackers.

Some of those diversions worked. Enea observed two-factor authentication codes being intercepted immediately after a diversion took effect — a sign the group was trying to break into those people’s other accounts. The report gives no similar evidence for voice calls, and it does not say whether any account was actually taken over. Interception made up 18.3% of the attacks Enea saw; for a typical surveillance company, the share is 2.1%. This group was mostly reading messages, not tracking locations.

Bursts, silent texts, and VIPs

SilentAir’s activity came in bursts: from one or a few subscribers to several thousand over a month, with gaps of up to several months between bursts. Outside Taiwan, targets were mostly elsewhere in Southeast and East Asia. Some were political and government VIPs, and in rare cases equipment in several countries worked together against the same target — pointing to a single controller.

The group also sent silent SMS messages on a very large scale, mainly to subscribers in Taiwan. A silent SMS is a text your phone never displays or alerts on. Most went to subscribers on other networks during the day — apparently to check whether a diversion had worked. Most silent texts went out at night, mostly to people in Taiwan — likely a bulk check that earlier diversions were still in place. The texts carried spam-like lines in English — a disguise.

Enea has tracked the group since early 2025. The clincher: equipment inside one operator was seen both sending and receiving attack commands. Enea found traces of unauthorized access, but could not analyze the malware behind it.

Who is behind it — and what is not proven

Enea links SilentAir to China only with low confidence. The signs: it focused on Taiwan, never targeted Chinese networks, and worked UTC+8 hours — 9 a.m. starts, weekends off, pauses around Chinese holidays.

Enea also considered a link to Liminal Panda, a group behind earlier telecom intrusions, and called it possible but unconfirmed. SilentAir’s behavior also partly matches SCTPE, a Linux trojan built to send and receive SS7 and Diameter traffic — the same tool Singapore’s IMDA described as SIGweaver. But Enea says SilentAir answered messages it had not sent itself, which SCTPE cannot do, and its operational security looked far better than Liminal Panda’s.

The group has been disrupted for now, Enea says, but could return — and the report does not say whether operators cleaned up the hacked equipment.

What this means for you

SilentAir is a targeted espionage campaign, not a mass hack — its victims were selected individuals. But the technique warns everyone who still gets login codes by text. An SMS code is only as safe as the signaling between carriers — and this campaign proved that signaling can be bent from the inside. We saw the same lesson from the other side this week: 125 million texts, including live bank codes, sitting in an exposed database — the code that is supposed to prove you are you keeps turning up where it should not be.

1. Move your important logins off SMS codes. Wherever a service offers an authenticator app, a hardware key, or passkeys, use that instead of text-message codes. SMS 2FA beats no second factor — but it is the weakest form, and this campaign shows why.

2. Watch for texts and calls that never arrive. A diversion that works means your messages go somewhere else. If login codes or bank alerts stop showing up while your signal looks fine, treat it as a signal, not a glitch — check with your carrier and your bank.

3. Treat a “new login” alert as urgent. If any service tells you a code was used or a login happened that was not you, change the password and revoke sessions immediately.

4. If you run a network, treat the IPX as untrusted. That is Enea’s advice to operators: deploy GTP firewalls, share their information with SS7 and Diameter firewalls, and add signaling detection inside your own network. The report offers no advice for individual targets — there is no setting on your phone that fixes a compromised carrier.

SilentAir did it quietly, from inside the networks themselves, for well over a year — and we only know because the diverted traffic answered back in a way that did not add up. It is the same pattern as the Turla campaign that turned government mail servers into listening posts: the infrastructure you trust is the infrastructure being used. The fix is not a patch on your phone. It is to stop treating a text message as proof of who you are.