SilentAir Intercepted SMS 2FA Inside the Telecom Network

TL;DR - On 11 November, the security firm Enea published research on SilentAir, a campaign that compromised telecom equipment in at least six Asian countries and used the carriers' own signalling network to divert calls and text messages. The targets were not the phones. The interception happened inside the mobile network, using the SS7 and Diameter protocols over the global IPX backbone, and Enea says some targeted users had their two-factor codes captured immediately after the diversion began. Enea did not establish any confirmed account takeovers, and the activity has been disrupted for now. The control weakness it exposes is not going away though: any login that trusts a code sent over the mobile network is trusting infrastructure outside your estate. What you need to do: find every account that still accepts SMS as a second factor, rank them by what a takeover would cost you, and move the administrative, financial and remote-access paths off SMS first.

By The Numbers

My phone buzzed while I was reading the Enea report, which is normally a fine coincidence and was not on this occasion. The report is about a campaign that intercepts SMS codes inside the mobile network, and the message on my screen was an SMS code for a service that has not yet moved to a better factor.

I have written about MFA rollout failure and about passkeys before, and the argument has always been that SMS is the weak factor you keep until you can replace it. This week's research puts a number on how weak, and the answer is that the interception happens in a place you cannot secure at all. It happens in the carrier network.

Let me walk you through what SilentAir did, why the telecom layer is the right place to attack a second factor, what the evidence does and does not prove, and what to move this week.

What SilentAir actually did

Enea, an Italian security firm that works on telecom threat intelligence, published research on 11 November describing a campaign it has been tracking since early 2025. The campaign, which Enea calls SilentAir, compromised equipment inside telecom operators in at least six Asian countries.

Once inside that equipment, the operators in the campaign used the carriers' own signalling systems to divert calls and text messages belonging to targeted users. The diversion is not something done to the phone. The phone does not need malware, a SIM swap, or a rogue app. The network that is supposed to deliver the message was instructed to deliver it somewhere else or to copy it on the way past.

Enea's report describes SS7 and Diameter as the protocols used. Both are signalling protocols that mobile networks use internally to set up calls, route messages, authenticate subscribers and move traffic between operators. They were designed for a closed world of trusted carriers, and the modern reality is a global interconnection backbone, the IPX network, across which those signals travel between hundreds of operators. The campaign used that backbone.

The probing method is worth knowing. Enea describes the use of silent SMS, messages that are delivered in a way that does not show up on the handset, as a way to check whether a target number is live and reachable before the operation proceeds. It is the reconnaissance step, and it leaves no trace on the phone.

Why the telecom network is the right place to attack a second factor

SMS two-factor authentication works because the code is sent to something the attacker supposedly does not have: your SIM, and by extension your phone. That is a reasonable assumption for an attacker who is trying to phish you, because they have to convince you to hand over the code.

It is a poor assumption for an attacker who is inside the network that delivers the code. If the message can be intercepted or copied in transit, then the second factor is not a secret between you and the service. It is a message travelling across infrastructure that you do not control, do not audit and cannot see.

That is the shift this research documents. The old story about SMS weaknesses was SIM swapping, where an attacker convinces the carrier to move your number to their SIM. That is a social engineering attack against a support desk, and it is detectable because your phone stops receiving messages. SilentAir is a different shape. Nothing happens to your SIM. Your phone may keep working normally. The messages simply also go somewhere else, and Enea reports that some targets had their two-factor codes captured immediately after a diversion began.

I want to be careful about the word immediate, because it is doing a lot of work. It means the attacker did not have to wait for a lucky window. The diversion was in place and the codes arrived through it.

What the evidence does and does not show

Enea's report is specific about several things and honest about the rest, and the honest parts matter.

What is established: compromised equipment in at least six Asian countries, the use of SS7 and Diameter signalling over the IPX backbone to divert calls and texts, silent SMS used for probing, and the interception of two-factor codes belonging to at least some targets.

What is not established: any confirmed account takeover. Enea did not connect the intercepted codes to a successful intrusion into an account. It observed the interception, and it did not observe the next step. That gap might be because there was no next step, or because the next step happened somewhere Enea could not see. Both readings are consistent with the evidence, and I am not going to pick one and present it as fact.

The attribution is also careful. Enea assesses a state-level actor and notes a China link at low confidence, which is researcher language for "we have a pointer and not a case". Treat the country question as open.

One more honest note: the campaign is described as disrupted, and Enea says it has told operators where the compromised sources are. That is good news with a short shelf life. The technique does not stop working because one set of compromised boxes was found. The signalling protocols still do what they were designed to do, and the operators who have not yet reviewed their interconnection paths still have the same exposure.

The separate story with the same weak control

On the same day, the FBI attributed more than 400 million US dollars in cryptocurrency theft to North Korean operators who used deepfake video calls to impersonate executives and convince employees to move funds.

That is a different campaign with a different mechanism, and I am mentioning it because it lands on the same control weakness. In the crypto case, the second factor that failed was human verification. A convincing synthetic face on a video call defeated the process that was supposed to confirm who was making the request. In the SilentAir case, the second factor that failed was a code carried over a network outside the organisation's control.

Both failures come from the same design habit: relying on a signal that the attacker can reach. If the attacker operates the channel that carries the verification, then the verification is not a control. It is a formality.

Why this could be good

The most useful thing Enea did was publish, and the way it published.

Telecom interception research usually arrives in one of two forms: a vendor white paper that describes a capability without evidence, or a disclosure that names a live compromise and gives no defender anything to act on. Enea's report does the harder thing. It names the campaign, describes the protocols and the technique, states the timeline it has tracked, and marks clearly where its confidence ends. The attribution is hedged in proportion to the evidence, and the absence of confirmed takeovers is stated rather than glossed over.

That is the version of this research a defender can actually use. It tells you the technique is real, that it has been running for the better part of two years, that it operated across multiple countries, and that the specific thing being taken was two-factor codes sent by SMS. Those facts are enough to make a decision about your own estate without needing to know the attacker's name.

The second good thing is that the disruption appears to have been coordinated, with operators told where the compromised equipment sits. Taking hostile access out of a carrier network is unglamorous work, and it is the reason a campaign that has been running since early 2025 is described as disrupted rather than ongoing.

Concerns

There are three practical concerns, and the first one is the least comforting.

First, you cannot fix this on your side of the boundary. The compromise was in the carrier's equipment, and Enea's remediation happened inside the operator's network. An organisation that uses SMS as a second factor has no visibility into the signalling path that carries the code. Best practice on your estate, including good password hygiene and EDR everywhere, changes nothing about whether the message is copied in transit.

Second, the protocols are not going away. SS7 and Diameter sit underneath how mobile networks interoperate, and replacing them is a decade-scale project for the industry, not a patch. Interconnection between operators is a global trust model, and it is exactly the kind of trust model that gets abused when one participant is compromised.

Third, disruption is temporary. Finding the compromised sources and removing them works until the next set of sources is compromised. The technique, the protocols and the trust relationship all still exist, and the knowledge of how to use them is now public.

What to do right now

1. Inventory every account that still accepts SMS as a second factor. Start with the ones that matter: email, identity and single sign-on, finance, payroll, remote access, and anything with administrator rights. You cannot prioritise what you have not listed.
2. Rank by blast radius, not by vendor familiarity. An SMS code protecting a newsletter subscription is not the same as an SMS code protecting the VPN, the finance system or your cloud tenant administrator account. Move the high-value paths off SMS first.
3. Move administrator and financial accounts to an app-based authenticator or a hardware key. Passkeys and hardware security keys do not depend on a message crossing a network. Where a service supports them, that is the upgrade. Where it only supports an app, app beats SMS.
4. Phase out SMS rather than switching it off in a panic. Ripping SMS out of everything at once produces lockouts and a support queue. The realistic sequence is: list everything, move the highest-value paths this month, then work down the list with a date attached to each.
5. Check whether your telco or provider offers number-port-protection. It does not stop signalling-level interception, and it does stop the SIM-swap variant that remains common. It is a cheap control that covers one of the two attack shapes.
6. Tell the business which logins still depend on SMS. A risk register line that says "we will move off SMS later" should be replaced with a named list and a date. The value of this research is that it turns a vague intention into a decision with a deadline.
7. Keep an eye on the medium term, not just the immediate fix. The evidence points to two-factor codes moving through telecom signalling as a systematic target, and it is worth treating FIDO2 and passkeys as the destination rather than an optional extra.

Key Takeaways

• Enea documented SilentAir on 11 November 2026. The campaign compromised telecom equipment in at least six Asian countries and used SS7 and Diameter signalling over the IPX backbone to divert calls and texts.
• The interception happens on the carrier network, not the phone. No SIM swap, handset malware or user interaction is required, and Enea reports some targets had 2FA codes captured immediately after a diversion began.
• Silent SMS was used for probing. These messages do not show up on the handset, so the reconnaissance leaves no trace on the target's device.
• No account takeovers were confirmed. Enea observed the code interception and did not establish the next step, so the honest reading is that interception was observed and takeover was not.
• Attribution is hedged. Enea assesses a state-level actor and marks the China link as low confidence. Treat the country question as open.
• Activity is disrupted and could return. The protocols and the interconnection trust model are unchanged, and removing specific compromised equipment does not remove the technique.
• The fix is to move off SMS, starting with the highest-value logins. App-based authenticators, passkeys and hardware keys do not depend on a message crossing a network you do not control.

FAQ

Does SilentAir mean my SMS codes are being intercepted right now? Not necessarily. The research covers a campaign against targets in at least six Asian countries, and Enea describes the activity as disrupted. The relevant point for everyone else is that the technique exists and works at the network layer, so any account that still uses SMS as a second factor carries that exposure.

What is the difference between this and a SIM swap? A SIM swap moves your number to an attacker's SIM, and you usually notice because your phone stops receiving messages. SilentAir diverted traffic using the carrier's own signalling, so nothing needs to happen to your SIM or your handset and the normal delivery can continue alongside the interception.

Do I need to rip out SMS two-factor today? No. Ripping it out in one go causes lockouts and a support backlog. The practical approach is to list every account using SMS, rank them by what a takeover would cost, and move the administrative, financial and remote access paths to app-based or hardware factors first.

Which factor should I move to? In order of preference: a hardware security key or passkey where the service supports it, then an app-based authenticator, then anything that is not SMS. The important property is that the factor does not depend on a message travelling over a network outside your control.

Does a carrier block or protection service fix this? Number-port protection and carrier account locks help against the SIM-swap variant and do not stop signalling-level interception. They are worth having, and they are not a substitute for moving your second factor off SMS.

How would I know if my organisation was targeted? You probably would not see it from your side. The interception happens in the carrier network, so your logs would show a successful login rather than an intercepted code. That invisibility is a reason to treat SMS as a residual risk rather than a monitored control.

Why is this being reported now if it started in early 2025? Enea says it has been tracking the activity since early 2025, and the report published on 11 November is the point at which it is sharing the assessment publicly, with the activity described as disrupted and operators told where the compromised equipment was.

What did the FBI deepfake story have to do with this? Nothing operationally, and the two are worth keeping separate. The FBI attributed more than 400 million dollars in crypto theft to North Korean operators using deepfake video calls. Different campaign, different mechanism, same underlying weakness: a verification step that relied on a channel the attacker could reach.

My Take

The uncomfortable lesson in SilentAir is not that SMS is weak. Most security people have said that for years, and plenty of organisations still run it because the upgrade list has never made it to the top of the budget.

The lesson is where the weakness sits. A second factor is supposed to be something the attacker does not have. When that factor is a message carried across a global interconnection backbone between hundreds of carriers, then what the attacker does not have is a promise. They do not have to phish you, swap your SIM or infect your phone. They only need access somewhere on the path, and the path is longer than any single organisation's security programme reaches.

So the practical version of this, for a business in Adelaide or Auckland that will never appear in Enea's report, is a list. Every login that still accepts an SMS code, ranked by what losing it would cost. Then a date beside the top ten, and the top ten moved to a key or an app. You cannot fix the carrier network. You can stop depending on it for the things that matter.

Further Reading

• Enea: SilentAir research - the report on the campaign, the protocols and the disruption
• The Hacker News: SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes - the independent write-up of the Enea findings
• The Hacker News: FBI says North Korean hackers stole over $400M in crypto using deepfake video calls - the same-week story about a failed verification step
• MFA rollout failure: what to fix before you try again - the change management side of moving an organisation's second factor
• The MFA fatigue playbook - push-bombing and the factor choices that reduce it
• Passkeys and what they change for your business - the destination for the accounts you take off SMS
• PayPal 2FA verification and the phishing pattern - how one-time codes get captured when the user is the weak link
• Spot a scam text before you click - the device-side cousin of the network-side problem in this post

Mathew Clark Founder, SecureInSeconds Currently: auditing which of my own logins still text me a code, and noticing that the answer is not zero Drafted with AI assistance - read, verified, and fixed by a human.