{"id":"CMP-202611-te5vs3","kind":"campaign","aliases":[],"related":[],"title":"China-linked SilentAir spies plant backdoors in telecom networks, using SS7 and Diameter commands to track phones and intercept calls and SMS, mostly in Taiwan (ENEA)","description":null,"summary":"Telecom security firm ENEA reports SilentAir, a Chinese cyber-espionage group active since at least early 2025, has backdoored telco networks in six countries, mostly Taiwan. The backdoors send malicious SS7 and Diameter signalling commands to collect device data, track subscriber locations and intercept calls and SMS; in rare cases it targeted VIPs such as political figures and government officials. ENEA links it to Liminal Panda (cooperation not confirmed). Activity described as ongoing. The affected telcos are not named, and no indicators were published in the coverage (reported via Risky Bulletin, 13 Nov 2026).","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-13T09:01:34+00:00","products":[{"name":"SS7","fixed":[]},{"name":"Diameter","fixed":[]}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Telcos: review SS7/Diameter signalling for location-tracking and SMS/call interception requests from unexpected sources and look for backdoors on core-network signalling nodes. Specific indicators: unknown (none in the coverage; check ENEA's report). Organizations with staff in Taiwan: assume SMS and voice can be intercepted.","fix":"Telcos: apply SS7/Diameter signalling firewall filtering and hunt for implants on core-network hosts. Everyone: do not rely on SMS for one-time codes or sensitive talk for high-risk staff (officials, executives, travellers to Taiwan); use app-based or passkey MFA and end-to-end encrypted messaging.","status":"open","published_at":null,"first_seen_at":"2026-11-13T09:01:34+00:00","triaged_at":"2026-11-13T09:01:34+00:00","updated_at":"2026-11-13T09:01:55+00:00","category":"infrastructure","confidence":null,"triage":{"cause":{"at":"2026-11-13T09:05:04Z","path":"third-party-breach","entry":"unknown","reason":"The record says SilentAir backdoored telco networks and sent malicious SS7 and Diameter commands to track subscribers and intercept calls and SMS, but it does not say how the attacker got into those networks.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-202611':29A '13':129B '2025':54B '2026':131B 'activ':49B,107B 'affect':112B 'backdoor':7A,56B,65B 'bulletin':128B 'call':21A,82B 'campaign':33B 'case':87B 'china':2A 'china-link':1A 'chines':44B 'cmp':28A 'collect':74B 'command':15A,72B 'confirm':106B 'cooper':104B 'countri':61B 'coverag':124B 'cyber':46B 'cyber-espionag':45B 'data':76B 'describ':108B 'devic':75B 'diamet':14A,70B 'diameter':32A 'earli':35B,53B 'early-warn':34B 'enea':27A,40B,98B 'espionag':47B 'figur':94B 'firm':39B 'govern':96B 'group':48B 'indic':119B 'intercept':20A,81B 'least':52B 'limin':102B 'link':3A,99B 'locat':79B 'malici':67B 'most':24A,62B 'name':116B 'network':10A,58B 'nov':130B 'offici':97B 'ongo':110B 'panda':103B 'phone':18A 'plant':6A 'polit':93B 'publish':121B 'rare':86B 'report':41B,125B 'riski':127B 'secur':38B 'send':66B 'signal':71B 'silentair':4A,42B 'sinc':50B 'six':60B 'sms':23A,84B 'spi':5A 'ss7':12A,31A,68B 'subscrib':78B 'taiwan':26A,63B 'target':89B 'te5vs3':30A 'telco':57B,113B 'telecom':9A,37B 'track':17A,77B 'use':11A 'via':126B 'vip':90B 'warn':36B","nicknames":["SilentAir","Liminal Panda"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["diameter","liminalpanda","silentair","ss7"],"ptokens":["diameter","ss7"],"labels":["campaign","earlywarning","high","infrastructure"],"campaign_type":"exploitation","search_a":"'-202611':29A 'backdoor':7A 'call':21A 'china':2A 'china-link':1A 'cmp':28A 'command':15A 'diamet':14A 'diameter':32A 'enea':27A 'intercept':20A 'link':3A 'most':24A 'network':10A 'phone':18A 'plant':6A 'silentair':4A 'sms':23A 'spi':5A 'ss7':12A,31A 'taiwan':26A 'te5vs3':30A 'telecom':9A 'track':17A 'use':11A","search_b":"'13':129B '2025':54B '2026':131B 'activ':49B,107B 'affect':112B 'backdoor':56B,65B 'bulletin':128B 'call':82B 'campaign':33B 'case':87B 'chines':44B 'collect':74B 'command':72B 'confirm':106B 'cooper':104B 'countri':61B 'coverag':124B 'cyber':46B 'cyber-espionag':45B 'data':76B 'describ':108B 'devic':75B 'diamet':70B 'earli':35B,53B 'early-warn':34B 'enea':40B,98B 'espionag':47B 'figur':94B 'firm':39B 'govern':96B 'group':48B 'indic':119B 'intercept':81B 'least':52B 'limin':102B 'link':99B 'locat':79B 'malici':67B 'most':62B 'name':116B 'network':58B 'nov':130B 'offici':97B 'ongo':110B 'panda':103B 'polit':93B 'publish':121B 'rare':86B 'report':41B,125B 'riski':127B 'secur':38B 'send':66B 'signal':71B 'silentair':42B 'sinc':50B 'six':60B 'sms':84B 'ss7':68B 'subscrib':78B 'taiwan':63B 'target':89B 'telco':57B,113B 'telecom':37B 'track':77B 'via':126B 'vip':90B 'warn':36B","search_c":"","cause_entry":"unknown","cause_path":"third-party-breach","disclosures_checked_at":null,"first_public_at":"2026-11-13T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-te5vs3","url":"https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T09:01:34+00:00","fetched_at":"2026-11-13T09:01:34+00:00","note":null,"cites":["https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/"]}],"documents":[{"id":144155,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3n26lk2jlbs2l","title":"@campuscodi.risky.biz: -Chinese APT uses SS7, Diameter attacks to spy on targets\n-Cyberattack takes dow","kind":"post","source":"bluesky","publisher":null,"text":"-Chinese APT uses SS7, Diameter attacks to spy on targets\n-Cyberattack takes down Poland's government platform\n-Brazil's largest port hit by cyberattack\n-Europol takes down Gootloader, CastleRAT, and StealC\n-SMS blaster arrested in Hungary\n\nN: news.risky.biz/risky-bullet...\nP: risky.biz/RBNEWS633/\nhttps://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/ https://risky.biz/RBNEWS633/\n\nlikes 3 reposts 1","published_at":"2026-11-13T08:40:06+00:00","relation":"describes","confidence":null,"note":null},{"id":144175,"url":"https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/","title":"Risky Bulletin: Chinese APT uses SS7, Diameter attacks to spy on targets","kind":"blog","source":"analyst","publisher":null,"text":"ENEA tracks SilentAir, a Chinese cyber-espionage group (linked by ENEA to Liminal Panda, cooperation unconfirmed), active since early 2025 against telcos in six countries, mostly Taiwan, and their subscribers, rarely VIPs (political figures, government officials). Plants backdoors in telco networks that send malicious SS7 and Diameter commands to collect device data, track subscriber locations and intercept calls and SMS. No IOCs given. Poland: ePUAP e-government portal temporarily suspended after a cyberattack detected this week; Minister of Digital Affairs Krzysztof Gawkowski said evidence suggests foreign adversaries are involved; investigation and restoration ongoing. Brazil: Port of Santos (Santos port authority, Sao Paulo) hit by cyberattack that began with a power outage after hackers accessed equipment exposed online, then spread through IT network; port on manual procedures for about five days; some systems (internet, telephone) restored; actor not identified (n0n extortion group hit same authority in October, 6M ransom refused). Sources: A Tribuna, World Ports, Ransomware Live.","published_at":"2026-11-13T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}