A state-level signalling actor called SilentAir compromised equipment inside mobile operators in six Asian countries and intercepted calls and texts — including SMS 2FA codes — by sending forged SS7 UpdateLocation messages into the global interconnect.
The attack is invisible at the device. The phone still shows the same signal bars, the same network name, the same behaviour. A diverted SMS simply does not arrive. There is no error.
The number that matters: 18.3% of SilentAir’s observed activity was interception. For a typical commercial surveillance firm, that number is 2.1%. This is not broad location tracking — it is targeted collection, and the 2FA captures show the attacker reaching the accounts tied to the phone number.
There is no CVE. The flaw is in the trust model of the global signalling interconnect: operators trust messages from other operators, SilentAir compromised real operators, and the attack came from a trusted sender.
Enea says the group is disrupted for now but could return. The compromised equipment cleanup is not confirmed.
For developers: if you’re building anything that relies on SMS for authentication or account recovery, SilentAir is the operational case for why that is not safe against a state-level actor. Passkeys and TOTP authenticators do not depend on the carrier’s signalling network — SMS 2FA does, and the carrier’s network is the attack surface.
Full analysis (mechanism, attribution, hunting indicators, operator mitigation checklist): https://threataft.com/articles/silentair-telecom-ss7-sms-2fa-interception
