In November 2026, telecom security researchers at Enea disclosed a sophisticated espionage campaign—designated SilentAir—that has compromised mobile network operators across at least six Asian countries. The operation specifically targets Taiwanese users, intercepting SMS-based two-factor authentication (2FA) codes and conducting call/text surveillance at the network layer. This is not a theoretical vulnerability in a signaling protocol specification; this is confirmed, active exploitation of operational telecommunications infrastructure by what Enea assesses with high confidence to be a state-level threat actor.
For enterprise security teams, the implications are severe. If your organization relies on SMS-based multi-factor authentication for employees, contractors, or customers in the Asia-Pacific region—particularly Taiwan—those authentication channels are currently compromised. Attackers operating at the SS7/Diameter signaling level can bypass perimeter defenses entirely, intercepting one-time passwords (OTPs) before they reach end-user devices. This creates a direct path to account takeover, lateral movement, and persistent access to corporate resources that appears legitimate in audit logs.
The SilentAir campaign demonstrates a maturation of telecom espionage from theoretical SS7 research (documented since 2014) to production-grade interception infrastructure. Organizations with operations in affected regions must immediately reassess their authentication architecture and implement network-layer detection capabilities for signaling anomalies.
Technical Analysis
Threat Actor Profile and Infrastructure
SilentAir operates with resources consistent with nation-state intelligence services. The group has established persistence within mobile operator core networks across six Asian countries, though specific operator names remain undisclosed pending remediation. Enea's threat intelligence team identified the campaign through anomalous SS7 (Signaling System 7) and Diameter protocol traffic patterns—specifically, unusual SendAuthenticationInfo (SAI) and UpdateLocation requests originating from unexpected global title addresses.
The campaign's infrastructure demonstrates several advanced characteristics:
Protocol Exploitation: SilentAir leverages legitimate SS7/Diameter interconnection points between operators. By compromising or spoofing Global Title (GT) addresses and point codes, the actor submits fraudulent Mobile Application Part (MAP) messages that reroute SMS delivery or force location updates to attacker-controlled Visitor Location Registers (VLRs).
Target Selection: Unlike broad SMS phishing campaigns, SilentAir focuses on specific individuals—predominantly Taiwanese government officials, technology sector employees, and defense contractors. This selectivity suggests prior reconnaissance and specific intelligence requirements rather than opportunistic harvesting.
Persistence Mechanisms: The actor maintains access through compromised Home Location Register (HLR) and Home Subscriber Server (HSS) components within operator networks. This allows real-time interception without requiring malware on target devices or exploitation of handset vulnerabilities.
Attack Chain and Interception Mechanics
From a defensive perspective, understanding the SilentAir interception chain is critical for detection:
-
Initial Compromise: The actor gains access to operator network infrastructure, likely through compromised vendor maintenance accounts, exposed Diameter signaling interfaces, or supply-chain compromise of telecom equipment.
-
Location Manipulation: Using SS7 MAP
UpdateLocationor DiameterUpdate-Location-Request(ULR) messages, SilentAir forces the target's device registration to a rogue VLR/MSC (Mobile Switching Center) under attacker control. -
Interception Activation: Once the device appears to roam onto the attacker's network infrastructure, all SMS traffic—including 2FA codes from banks, enterprise VPNs, and SaaS applications—routes through SilentAir-controlled systems before delivery.
-
Real-time Harvesting: The actor captures OTPs in real-time, using them within their validity window (typically 30-90 seconds) to authenticate to target services.
-
Traffic Restoration: To avoid detection, the actor may terminate the interception session after capturing required codes, restoring normal routing and minimizing anomalous signaling traffic that could trigger operator fraud detection systems.
Affected Infrastructure and Platforms
While specific operator names remain confidential, the campaign affects:
- Mobile Network Operators: Six confirmed countries in Asia, with Taiwan as the primary targeting focus
- Protocol Layers: SS7 (MAP, CAP protocols) and Diameter (S6a/S6d interfaces)
- Authentication Systems: Any service relying on SMS-delivered OTPs, including:
- Enterprise VPN concentrators (Cisco AnyConnect, Palo Alto GlobalProtect, Fortinet FortiGate)
- Cloud identity providers (Okta, Microsoft Entra ID, Google Workspace)
- Financial services and banking applications
- Government and defense communication systems
No CVE identifiers are currently assigned to this campaign, as it exploits architectural trust relationships in telecommunications protocols rather than software vulnerabilities in specific products. The weakness lies in the SS7/Diameter protocol design assumptions about network trust, not in patchable code defects.
Exploitation Status
This is confirmed active exploitation of telecommunications infrastructure. Enea has identified specific attack sources and interception infrastructure. The campaign is ongoing as of November 2026, with evidence suggesting operational activity dating back at least 18 months. There is no public proof-of-concept code, as exploitation requires physical or logical access to operator core networks—however, the techniques are well-documented in telecommunications security research and require only protocol knowledge, not zero-day exploits.
Detection & Response
Sigma Rules for Telecom Signaling Anomalies
The following Sigma rules target endpoint and network behaviors associated with telecom-level interception. Note that direct SS7 detection requires specialized telecom monitoring; these rules focus on the enterprise authentication anomalies that indicate successful interception.
---
title: Multiple SMS OTP Requests From Impossible Travel Locations
id: 8f4a2c91-3b7d-4e5f-9a2c-1d8e6f4a9b3c
status: experimental
description: Detects authentication attempts using SMS OTPs where the source IP geolocation is inconsistent with the user's registered location, indicating potential SS7-level interception and replay from foreign infrastructure.
references:
- https://attack.mitre.org/techniques/T1078/
- https://attack.mitre.org/techniques/T1557/
author: Security Arsenal
date: 2026/11/18
tags:
- attack.initial_access
- attack.t1078
- attack.t1557
logsource:
product: azure
service: signinlogs
detection:
selection:
properties.authenticationRequirement: 'multiFactorAuthentication'
properties.status.errorCode: 0
properties.authenticationDetails.authenticationMethod: 'SMS'
filter_taiwan_ips:
properties.ipAddress|cidr:
- '203.0.113.0/24' # Example Taiwan IP range - replace with actual corporate ranges
- '198.51.100.0/24'
condition: selection and not filter_taiwan_ips
falsepositives:
- Legitimate business travel
- VPN usage
- Mobile network roaming
level: high
---
title: Rapid Succession Authentication Events From Diverse Geographic Locations
id: 2b8e4f6a-9c3d-4a1e-8f5b-7d2c9e4a6f1b
status: experimental
description: Identifies multiple successful authentications within a short timeframe from geographically distant locations, indicating potential OTP interception and concurrent usage by attacker and legitimate user.
references:
- https://attack.mitre.org/techniques/T1557/
author: Security Arsenal
date: 2026/11/18
tags:
- attack.initial_access
- attack.t1557
logsource:
category: authentication
product: windows
detection:
selection:
EventID: 4624
LogonType: 10 # RemoteInteractive (RDP)
timeframe: 5m
condition: selection | count() by TargetUserName > 3
falsepositives:
- Load-balanced authentication servers
- Mobile users switching networks
level: medium
---
title: Unusual Diameter Protocol Traffic From Unexpected Sources
id: 5c9a3e7b-4f2d-4a8c-9e1b-6d4f8a2c5e9b
status: experimental
description: Detects Diameter signaling protocol messages (ports 3868, 5658) originating from IP addresses not on the approved peer list, indicating potential rogue network elements or SS7/Diameter gateway compromise.
references:
- https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/11/18
tags:
- attack.command_and_control
- attack.t1071
logsource:
category: network_connection
product: linux
detection:
selection:
DestinationPort:
- 3868 # Diameter
- 5658 # Diameter over TLS
filter_known_peers:
SourceIP|cidr:
- '10.0.0.0/8' # Internal network
- '172.16.0.0/12' # RFC1918
- '192.168.0.0/16' # RFC1918
condition: selection and not filter_known_peers
falsepositives:
- New legitimate roaming partners
- Network misconfiguration
level: high
KQL Hunting Queries (Microsoft Sentinel / Defender)
These queries hunt for authentication anomalies and network patterns indicative of SMS interception campaigns. Deploy these in Microsoft Sentinel with appropriate watchlists for Taiwanese users or high-risk personnel.
// Hunt for SMS-based authentications with anomalous characteristics
// Deploy with a watchlist of users known to be in Taiwan or targeted regions
let HighRiskUsers = externaldata(UserPrincipalName: string)[
@"https://raw.githubusercontent.com/yourorg/watchlists/main/taiwan-users.csv"
] with (format="csv", ignoreFirstRecord=true);
let TimeWindow = 1h;
SigninLogs
| where TimeGenerated > ago(24h)
| where AuthenticationRequirement == "multiFactorAuthentication"
| where AuthenticationMethodsUsed has "SMS"
| where ResultType == 0 // Success
| extend Location = parse_json(LocationDetails)
| extend Country = tostring(Location.countryOrRegion)
| extend City = tostring(Location.city)
| join kind=inner HighRiskUsers on UserPrincipalName
| summarize
AuthCount = count(),
UniqueCountries = dcount(Country),
Countries = make_set(Country),
Cities = make_set(City)
by UserPrincipalName, bin(TimeGenerated, TimeWindow)
| where UniqueCountries > 1 or AuthCount > 3
| project TimeGenerated, UserPrincipalName, AuthCount, Countries, Cities
| sort by TimeGenerated desc;
// Detect impossible travel patterns for SMS-authenticated sessions
SigninLogs
| where TimeGenerated > ago(7d)
| where AuthenticationMethodsUsed has "SMS"
| where ResultType == 0
| extend Location = parse_json(LocationDetails)
| extend Country = tostring(Location.countryOrRegion)
| extend Lat = todouble(Location.geoCoordinates.latitude)
| extend Lon = todouble(Location.geoCoordinates.longitude)
| sort by UserPrincipalName asc, TimeGenerated asc
| serialize
| extend PrevLat = prev(Lat), PrevLon = prev(Lon), PrevTime = prev(TimeGenerated)
| extend SpeedKmh = case(
PrevLat == 0, 0.0,
geo_distance_2points(Lon, Lat, PrevLon, PrevLat) / 1000.0 / ((TimeGenerated - PrevTime) / 1h)
)
| where SpeedKmh > 800 // Faster than commercial air travel
| project TimeGenerated, UserPrincipalName, IPAddress, Country, SpeedKmh, PrevTime;
// Monitor for Diameter/SS7 protocol anomalies in network logs (if ingested via CEF/Syslog)
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort in (3868, 5658, 2905, 2904) // Diameter and SS7-related ports
| where DeviceVendor != "Trusted Telecom Vendor" // Filter known infrastructure
| summarize
ConnectionCount = count(),
UniqueSources = dcount(SourceIP),
Protocols = make_set(ApplicationProtocol)
by DestinationIP, DestinationPort, bin(TimeGenerated, 1h)
| where UniqueSources > 5 or ConnectionCount > 100
| project TimeGenerated, DestinationIP, DestinationPort, UniqueSources, ConnectionCount;
Velociraptor VQL for Endpoint Forensics
While SilentAir operates at the network layer, endpoint forensics can identify secondary compromise following successful 2FA bypass. This VQL hunts for suspicious authentication client modifications and credential theft artifacts.
-- Hunt for suspicious modifications to authentication-related binaries and configurations
-- Useful for detecting post-exploitation following successful OTP interception
SELECT
FullPath,
Size,
Mtime,
Ctime,
hash(path=FullPath) as FileHash
FROM glob(globs='''C:\Program Files\**\*.dll''')
WHERE
FullPath =~ '(vpn|auth|okta|duo|rsa|securid)'
AND (
Mtime > '2026-01-01'
OR Ctime > '2026-01-01'
)
AND NOT FullPath =~ 'Program Files\\\\Windows Defender'
ORDER BY Mtime DESC
LIMIT 100;
-- Check for unauthorized PAM (Pluggable Authentication Module) modifications on Linux systems
SELECT
File.Name as PamModule,
File.Size,
File.Mtime,
File.Mode
FROM glob(globs='''/etc/pam.d/*''')
WHERE
File.Mtime > '2026-01-01'
AND File.Name =~ '(common-auth|sshd|login|sudo)'
ORDER BY File.Mtime DESC;
-- Network connections to suspicious telecom signaling ports (if endpoint has telecom tools)
SELECT
Pid,
Name,
CommandLine,
netstat().RemoteAddress as RemoteAddr,
netstat().RemotePort as RemotePort,
netstat().Status as ConnStatus
FROM pslist()
WHERE
netstat().RemotePort in (3868, 5658, 2904, 2905, 2906)
OR netstat().RemoteAddr =~ '(10\\.|192\\.168\\.|172\\.)'
Remediation Script
This PowerShell script audits authentication logs for SMS-based OTP usage and flags potentially compromised sessions based on geographic anomalies. It also generates a report for identity team review.
#Requires -Module AzureAD
<#
.SYNOPSIS
SilentAir SMS Interception Detection Script
.DESCRIPTION
Audits Azure AD sign-in logs for SMS-based MFA usage with geographic anomalies
indicating potential SS7-level interception. Generates incident report for
security operations center review.
.NOTES
Author: Security Arsenal IR Team
Date: 2026-11-18
Requires: AzureAD PowerShell module, Global Reader or Security Reader role
#>
[CmdletBinding()]
param(
[Parameter(Mandatory=$false)]
[string[]]$TargetUserUPNs,
[Parameter(Mandatory=$false)]
[int]$DaysBack = 7,
[Parameter(Mandatory=$false)]
[string]$OutputPath = ".\SilentAir_Audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
)
begin {
Write-Verbose "Connecting to Azure AD..."
try {
Connect-AzureAD -ErrorAction Stop | Out-Null
}
catch {
Write-Error "Failed to connect to Azure AD: $_"
exit 1
}
$StartDate = (Get-Date).AddDays(-$DaysBack)
$SuspiciousEvents = @()
# Known safe countries for your organization (customize as needed)
$SafeCountries = @('US', 'CA', 'GB', 'DE', 'FR', 'JP', 'AU')
}
process {
# Get all users if not specified
if (-not $TargetUserUPNs) {
Write-Verbose "Retrieving all users with recent SMS MFA usage..."
$Users = Get-AzureADUser -All $true | Where-Object {$_.AccountEnabled -eq $true}
}
else {
$Users = foreach ($UPN in $TargetUserUPNs) {
Get-AzureADUser -ObjectId $UPN -ErrorAction SilentlyContinue
}
}
foreach ($User in $Users) {
Write-Verbose "Processing $($User.UserPrincipalName)..."
# Get sign-in logs
$SignIns = Get-AzureADAuditSignInLogs -Filter "userPrincipalName eq '$($User.UserPrincipalName)' and createdDateTime ge $($StartDate.ToString('yyyy-MM-dd'))" -All $true
# Filter for SMS MFA and analyze
$SMSAuths = $SignIns | Where-Object {
$_.AuthenticationDetails -match 'SMS' -and
$_.Status.ErrorCode -eq 0
}
foreach ($Auth in $SMSAuths) {
$Location = $Auth.Location
$IsSuspicious = $false
$SuspiciousReasons = @()
# Check for impossible travel
$PrevAuth = $SMSAuths | Where-Object {
$_.CreatedDateTime -lt $Auth.CreatedDateTime
} | Sort-Object CreatedDateTime -Descending | Select-Object -First 1
if ($PrevAuth) {
$TimeDiff = ($Auth.CreatedDateTime - $PrevAuth.CreatedDateTime).TotalHours
if ($TimeDiff -gt 0) {
$Distance = [math]::Round(
[System.Device.Location.GeoCoordinate]::new(
$Auth.Location.GeoCoordinates.Latitude,
$Auth.Location.GeoCoordinates.Longitude
).GetDistanceTo(
[System.Device.Location.GeoCoordinate]::new(
$PrevAuth.Location.GeoCoordinates.Latitude,
$PrevAuth.Location.GeoCoordinates.Longitude
)
) / 1000, 2
)
$SpeedKmh = [math]::Round($Distance / $TimeDiff, 2)
if ($SpeedKmh -gt 800) {
$IsSuspicious = $true
$SuspiciousReasons += "Impossible travel: $SpeedKmh km/h"
}
}
}
# Check for unusual countries
if ($Auth.Location.CountryOrRegion -notin $SafeCountries) {
$IsSuspicious = $true
$SuspiciousReasons += "Unusual country: $($Auth.Location.CountryOrRegion)"
}
# Check for rapid succession auths
$RecentAuths = $SMSAuths | Where-Object {
[math]::Abs(($_.CreatedDateTime - $Auth.CreatedDateTime).TotalMinutes) -lt 5
}
if ($RecentAuths.Count -gt 2) {
$IsSuspicious = $true
$SuspiciousReasons += "Multiple auths within 5 minutes"
}
if ($IsSuspicious) {
$SuspiciousEvents += [PSCustomObject]@{
Timestamp = $Auth.CreatedDateTime
UserPrincipalName = $Auth.UserPrincipalName
IPAddress = $Auth.IPAddress
Country = $Auth.Location.CountryOrRegion
City = $Auth.Location.City
AuthMethod = 'SMS'
SuspiciousReasons = $SuspiciousReasons -join '; '
AppDisplayName = $Auth.AppDisplayName
ResourceDisplayName = $Auth.ResourceDisplayName
RiskLevel = if ($SuspiciousReasons -match 'Impossible') { 'High' } else { 'Medium' }
}
}
}
}
}
end {
if ($SuspiciousEvents.Count -gt 0) {
Write-Warning "Found $($SuspiciousEvents.Count) suspicious SMS authentication events!"
$SuspiciousEvents | Export-Csv -Path $OutputPath -NoTypeInformation
Write-Host "Report exported to: $OutputPath" -ForegroundColor Yellow
# Display high-risk events
$SuspiciousEvents | Where-Object {$_.RiskLevel -eq 'High'} | Format-Table -AutoSize
}
else {
Write-Host "No suspicious SMS authentication events detected." -ForegroundColor Green
}
# Summary statistics
$Stats = @{
TotalUsersAnalyzed = $Users.Count
TotalSMSAuths = ($SMSAuths | Measure-Object).Count
SuspiciousEvents = $SuspiciousEvents.Count
HighRiskEvents = ($SuspiciousEvents | Where-Object {$_.RiskLevel -eq 'High'}).Count
}
Write-Host "`nAnalysis Summary:" -ForegroundColor Cyan
$Stats.GetEnumerator() | ForEach-Object { Write-Host " $($_.Key): $($_.Value)" }
}
Remediation
Immediate action is required for organizations with personnel in Taiwan or Asia-Pacific operations. The following steps address both the immediate interception risk and long-term authentication architecture improvements.
Immediate Actions (24-48 Hours)
-
Disable SMS-Based 2FA for High-Risk Users
- Identify all personnel physically located in Taiwan or traveling to affected regions
- Force migration to authenticator apps (Microsoft Authenticator, Google Authenticator, Authy) or FIDO2 hardware keys (YubiKey, Titan Security Key)
- For VPN access: Implement certificate-based authentication or TOTP (Time-based One-Time Password) as primary factors
-
Enable Conditional Access Policies
- Block SMS MFA entirely for privileged accounts (Global Admins, C-level executives, IT administrators)
- Require FIDO2 or certificate-based authentication for access to sensitive resources from Taiwan IP ranges
- Implement "impossible travel" detection with automatic session revocation
-
Network Monitoring for Telecom Anomalies
- If operating private LTE/5G infrastructure: Enable logging for Diameter/SS7 interfaces and monitor for unexpected Global Title (GT) addresses
- Review firewall logs for outbound connections to ports 3868 (Diameter) and 2905 (M3UA/SIGTRAN) from unexpected sources
- Alert on any SS7/Diameter traffic originating from user VLANs or DMZ segments (should only exist in core network segments)
Medium-Term Mitigations (1-4 Weeks)
-
Implement Number Verification APIs
- Deploy services like Twilio Lookup, Neustar, or Telesign to verify phone number current location against expected user location
- Flag authentication attempts where the mobile device reports a network location (MCC/MNC) inconsistent with the user's registered address
- Block OTP delivery if the device appears to be roaming on a high-risk network
-
Voice Call Verification as Fallback
- Replace SMS with automated voice calls for OTP delivery—significantly harder to intercept via SS7 without sophisticated IMSI-catcher infrastructure
- Ensure voice systems use randomized, non-predictable number sequences and implement rate limiting
-
Enhanced Logging and Correlation
- Forward all authentication logs to SIEM with geolocation enrichment
- Create correlation rules linking SMS OTP request timestamps with subsequent successful authentications from different geographic locations
- Implement user behavior analytics (UBA) to detect when authentication patterns deviate from established baselines (device fingerprint, time of day, ASN)
Strategic Architecture Changes (1-6 Months)
-
Migrate to Phishing-Resistant MFA
- Deploy FIDO2/WebAuthn for all external-facing applications
- Implement certificate-based device authentication for managed endpoints
- Adopt Microsoft Entra ID Certificate-Based Authentication (CBA) or Okta FastPass for zero-trust architectures
-
Telecom Threat Intelligence Integration
- Subscribe to telecom-specific threat feeds (Enea, AdaptiveMobile, Positive Technologies) for indicators of compromise related to SS7/Diameter attacks
- Monitor for your organization's phone number ranges appearing in signaling surveillance reports
-
Vendor Risk Assessment
- If operating MVNO (Mobile Virtual Network Operator) services or enterprise mobile agreements, demand transparency from carriers regarding:
- SS7/Diameter firewall implementations
- Global Title (GT) filtering policies
- Location tracking safeguards (3GPP TS 33.200 compliance)
- Include telecom infrastructure compromise in business continuity planning
- If operating MVNO (Mobile Virtual Network Operator) services or enterprise mobile agreements, demand transparency from carriers regarding:
Verification and Testing
After implementing these controls, validate effectiveness:
- Conduct red team exercises simulating SS7-based interception (using tools like SigPloit in controlled lab environments)
- Test conditional access policies using Microsoft's What If tool or Okta's System Log simulation
- Verify that authenticator app-based TOTP codes cannot be intercepted via network-level attacks (they are generated on-device, not transmitted)
There is no vendor patch for this threat—it requires architectural defense-in-depth. Organizations must assume that SMS delivery in affected regions is compromised until SilentAir infrastructure is fully dismantled.
Related Resources
Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.