FlagThis — Daily Cybersecurity Intelligence Briefing

Liminal Panda, a state-aligned APT tracked alongside SilentAir, compromises mobile core networks by exploiting SS7 MAP/CAP and Diameter signaling protocols. The actor conducts cross-border espionage targeting Taiwanese and Asian telecom subscribers through SMS interception, voice call monitoring, real-time location tracking, and roaming interface abuse. Persistence is maintained via BPFdoor, an eBPF-based sleeper-cell implant deployed within telco environments. This signaling infrastructure compromise enables state-linked intelligence collection across global mobile networks without direct endpoint malware deployment.