Fast Facts
- Compromised mobile-operator equipment in at least six Asian countries injected SS7/Diameter signaling to divert targeted calls and texts, mainly in Taiwan.
- Some diversions intercepted 2FA codes immediately, potentially enabling access to victims’ other accounts; no account takeovers were confirmed.
- SilentAir sent large volumes of hidden SMS, mostly to Taiwan, apparently to check whether interception diversions were working.
Threat, Techniques, and Targets
• Enea identified SilentAir, a group that used compromised equipment inside mobile operators in at least six Asian countries. Enea assessed with high confidence that the group acted at a state level. It linked the group to China with low confidence.
• SilentAir sent signaling messages over the trusted IPX network. It used UpdateLocation messages through SS7 or Diameter to make a target’s home network divert calls and texts to attacker controlled equipment.
• Some diversions worked. Enea observed attackers intercepting two factor authentication codes soon after diversion. However, the report does not confirm account takeovers or similar interception of voice calls.
• SilentAir mainly targeted people in Taiwan, including political and government VIPs. It also targeted people in other regions. Additionally, it sent large numbers of silent SMS, mainly to Taiwanese subscribers, though the purpose of many nighttime messages remains unclear.
Impact, Security Implications, and Remediation
• The attacks exposed selected users’ text messages and authentication codes. Enea said interception made up 18.3% of the SilentAir attacks it observed. The group has been disrupted for now, but Enea did not confirm that operators removed all compromised equipment.
• The attacks show how compromised operator equipment and trust between mobile networks can enable surveillance. Enea also warned that other attackers could reuse these techniques.
• Enea recommends that operators deploy GTP-C and GTP-U firewalls and connect them with SS7 and Diameter defenses. It also recommends treating the IPX as untrusted, monitoring signaling traffic inside operator networks, and linking signaling security with broader IT security.
• The report offers no specific advice for affected users. Therefore, users should seek guidance from their mobile operator or a relevant authority.
Stay Ahead with the Latest Tech Trends
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
