Enea identifies telecom intrusions that intercepted authentication texts

Enea identified a spying group using compromised equipment inside Asian mobile operators to divert texts, including two-factor authentication codes, from selected subscribers, mostly in Taiwan. The company named the group SilentAir this week and found attack sources in at least six Asian countries. The attackers sent signaling messages falsely telling subscribers' home networks that the compromised equipment was serving their phones. Accepted messages redirected traffic to the attackers. Enea said the activity has been disrupted for now but could return. It assessed SilentAir as a state-level actor with high confidence, while linking it to China with low confidence. It did not establish whether intercepted codes led to account takeovers.