Liminal Panda Exploits SS7 and Diameter Signaling Protocols for Cross-Border Telecom Espionage

Liminal Panda, a state-aligned APT tracked alongside SilentAir, compromises mobile core networks by exploiting SS7 MAP/CAP and Diameter signaling protocols. The actor conducts cross-border espionage targeting Taiwanese and Asian telecom subscribers through SMS interception, voice call monitoring, real-time location tracking, and roaming interface abuse. Persistence is maintained via BPFdoor, an eBPF-based sleeper-cell implant deployed within telco environments. This signaling infrastructure compromise enables state-linked intelligence collection across global mobile networks without direct endpoint malware deployment.

• Incident Overview: Liminal Panda / SilentAir Campaign

  • State-aligned APT conducting cross-border espionage via mobile telecom signaling infrastructure.
  • Primary targets include Taiwanese subscribers and Asian mobile network operators.
  • Campaign objectives: SMS interception, voice surveillance, subscriber location tracking, and persistent intelligence access.
  • Activity linked to SilentAir tracking and global mobile network infiltration.

• Attack Vector: SS7 and Diameter Signaling Abuse

  • Exploitation of SS7 MAP/CAP protocols for signaling manipulation and SMS forwarding.
  • Abuse of Diameter signaling interfaces in 4G/LTE and roaming networks.
  • Cross-border signaling spoofing and roaming interface exploitation to bypass inter-carrier trust boundaries.
  • Signaling queries leveraged for real-time subscriber location tracking without handset compromise.

• Threat Group Profile and Scale of Impact

  • Tracked in conjunction with SilentAir; state-aligned actor focused on espionage.
  • Infiltrated global mobile networks with emphasis on Asian telecom providers.
  • Impact includes compromise of mobile subscribers, interception of communications, and persistent core network access.
  • Enables intelligence collection without direct endpoint compromise on victim devices.

• Persistence Mechanism: BPFdoor eBPF Implant

  • Deployment of BPFdoor, an eBPF-based sleeper-cell implant within telecom environments.
  • Provides persistent access to telco core networks for long-term intelligence collection.
  • Operates at kernel/network layer, evading traditional endpoint and host-based detection.
  • Facilitates continued signaling manipulation and covert access after initial intrusion.

• Detection and Defensive Actions

  • Monitor SS7 and Diameter signaling traffic for anomalous MAP/CAP queries and spoofed messages.
  • Audit roaming interfaces and signaling gateways for unauthorized signaling access.
  • Detect eBPF-based implants and kernel-level persistence mechanisms in telco core systems.
  • Implement signaling firewalls, mutual authentication, and cross-border traffic filtering.

• Conclusion

  • Signaling protocol weaknesses remain a critical vector for state-linked telecom espionage.
  • Liminal Panda demonstrates the risk of core network infiltration without endpoint malware.
  • Telecom operators must treat signaling infrastructure as a high-value security boundary.