FlagThis — Daily Cybersecurity Intelligence Briefing

SilentAir, a state-linked APT, compromises Asian telecommunications infrastructure to intercept SMS-based two-factor authentication codes targeting Taiwan mobile subscribers. The group exploits SS7/SIGTRAN signaling vulnerabilities and breached OSS/BSS management interfaces to access Home Location Register (HLR) and Home Subscriber Server (HSS) systems, enabling SMS redirection and one-time passcode capture. This bypasses SMS 2FA for government, financial, and technology sector accounts without endpoint compromise. C2 uses DNS tunneling or encrypted channels over ports 443/8443. Impact includes credential theft and persistent espionage across thousands of subscribers.