Shadow Operators: SilentAir and Liminal Panda Threaten Global Telecommunications Infrastructure

A newly identified, highly sophisticated state-level threat actor has been unmasked as the perpetrator behind a series of covert operations targeting mobile telecommunications operators across Asia. According to fresh intelligence released on November 11 by the telecommunications software and cybersecurity firm Enea, this group—dubbed "SilentAir"—has been systematically compromising carrier infrastructure to intercept sensitive communications, with a distinct and aggressive focus on subscribers within Taiwan.

Enea, which has been closely monitoring the actor’s movements since early 2025, characterizes SilentAir as a high-tier adversary possessing the technical capability and resources typical of a state-sponsored entity. The group’s modus operandi involves the hijacking of equipment belonging to mobile network operators across at least six Asian nations. From these compromised vantage points, the attackers have launched a series of calculated signaling attacks against targets spanning a dozen additional countries and territories.

The Rise of SilentAir and Targeted Surveillance

The discovery of SilentAir comes amid a broader analysis of the evolving threat landscape in the telecommunications sector. Enea’s latest research also sheds new light on the activities of "Liminal Panda," another group known for infiltrating mobile networks. While Enea has identified potential overlaps between the two entities, it maintains that a direct, proven connection remains speculative at this stage.

SilentAir’s approach to espionage is both methodical and persistent. The group executes its campaigns in distinct, episodic waves. Activity levels fluctuate significantly, ranging from the targeting of a handful of subscribers to thousands within a single month, often separated by months of relative dormancy. This "low and slow" approach appears designed to minimize the group’s digital footprint and avoid triggering automated security alerts within the host networks.

One of the most striking findings in Enea’s research is the primary objective of these incursions: interception. While the vast majority of malicious activity in the signaling space—often attributed to commercial surveillance vendors—rarely goes beyond basic location tracking or data collection, SilentAir is different. Enea reports that interception accounts for 18.30% of the group’s total activity, a stark contrast to the 2.07% seen from typical surveillance companies.

The human impact of these operations is significant. Enea documented instances where two-factor authentication (2FA) codes were intercepted almost immediately after the surveillance began. This suggests that the attackers are not merely gathering metadata but are actively seeking to bypass account security to gain unauthorized access to the personal, financial, or professional accounts of their targets.

Further evidence of the group’s clandestine nature is found in their use of "silent SMS" messages. These are text messages engineered to be invisible to the user, never appearing on the device’s screen or in the messaging history. These messages are primarily deployed against Taiwanese users, with a curious operational cadence that sees them sent largely around midnight, perhaps to further avoid detection by the targeted subscribers.

Enea has linked SilentAir to China-nexus operations, though it categorizes its confidence in this attribution as "low." The assessment is based on a confluence of circumstantial indicators: the intense focus on Taiwan, the deliberate absence of Chinese targets, and the operational working hours which align precisely with China’s time zone. Furthermore, the group’s activity lulls coincide with major Chinese holidays, a pattern often seen in state-sponsored campaigns. The intelligence suggests that the targets are not random; they include political and government VIPs, marking this as a high-stakes espionage effort rather than a generic criminal enterprise.

Liminal Panda and the Evolution of GTPDoor

While SilentAir dominates the signaling-based landscape, the group known as Liminal Panda continues to pose a severe, evolving threat to global network security. Enea’s cybersecurity firewalls, deployed across various customer networks, began detecting and blocking Liminal Panda’s signature activity—including the infamous "GTPDoor" backdoor—as early as 2026.

GTPDoor is a sophisticated Unix-based backdoor designed to operate within the GPRS Tunneling Protocol (GTP), the standard protocol used for roaming data. By hiding its command-and-control (C2) traffic within legitimate roaming data streams, the malware can effectively bypass traditional network security perimeters. Enea reported detecting several hundred attempted C2 exchanges, confirming that the threat is not merely theoretical but a persistent, active menace.

The scale of the Liminal Panda infection is difficult to ascertain, but Enea suggests it is widespread. The firm has identified at least five to 10 operators that have been directly infected, though they believe the true number of compromised entities could reach into the dozens. These infections are geographically dispersed, with significant concentrations identified across Asia, Africa, and Latin America.

Perhaps most concerning is the discovery of a new iteration of GTPDoor that exploits the GTP-U (user plane) component of the protocol. Unlike the control plane, which is more closely monitored, the user plane carries actual subscriber data. It is inherently heavier and more complex, making it significantly harder for network administrators to inspect for anomalous traffic. Furthermore, unlike the older control-side mechanisms, this user-plane traffic is carried over into 5G networks, potentially future-proofing the malware against network upgrades. Enea currently believes this new version serves primarily as a fallback mechanism, ensuring the attackers maintain a persistent foothold even if their primary C2 channels are severed.

The attribution of Liminal Panda remains complex. Previous reports, including analysis from CrowdStrike in November 2024, have linked the group to China-nexus operations, though those assessments also carried a low-confidence rating. The persistence of these groups highlights a structural vulnerability in global telecommunications: the inherent trust placed in inter-operator signaling protocols that were never designed with the modern threat landscape in mind.

The Path Forward for Telecom Security

The emergence of SilentAir and the persistence of Liminal Panda underscore a critical reality for the telecommunications industry. While companies like Enea are actively working to assist operators in purging these threats from their networks, the underlying systemic vulnerabilities remain. By alerting operators and providing the technical intelligence necessary to clear malicious implants, security firms are providing a temporary reprieve. However, the threat actors remain highly motivated, and the infrastructure they exploit is often difficult to patch without causing major service disruptions.

Enea has issued a stark warning: while both SilentAir and Liminal Panda have suffered setbacks, the conditions that allowed for their initial infiltration—such as the legacy signaling protocols and the challenges of monitoring massive volumes of roaming traffic—persist. Without fundamental shifts in how global carriers manage and secure their inter-network communications, the threat of state-level interception and covert surveillance is unlikely to vanish. For now, the global telecommunications sector remains a primary theater of modern, silent warfare, where the most dangerous attacks are the ones that never trigger a notification on the victim’s phone.