SilentAir APT: SMS 2FA Interception Campaign Targeting Taiwan Mobile Subscribers

SilentAir, a state-linked APT, compromises Asian telecommunications infrastructure to intercept SMS-based two-factor authentication codes targeting Taiwan mobile subscribers. The group exploits SS7/SIGTRAN signaling vulnerabilities and breached OSS/BSS management interfaces to access Home Location Register (HLR) and Home Subscriber Server (HSS) systems, enabling SMS redirection and one-time passcode capture. This bypasses SMS 2FA for government, financial, and technology sector accounts without endpoint compromise. C2 uses DNS tunneling or encrypted channels over ports 443/8443. Impact includes credential theft and persistent espionage across thousands of subscribers.

• Incident Overview: SilentAir SMS 2FA Interception

  • State-linked APT targeting Taiwan mobile subscribers with broader Asian telecom scope.
  • Objective: bypass SMS 2FA to compromise government, financial, and semiconductor accounts.
  • Enables persistent espionage and credential theft without endpoint compromise.

• Attack Vector: Telecom Signaling and OSS/BSS Compromise

  • Exploitation of SS7/SIGTRAN MAP/TCAP messages for SMS interception.
  • Unauthorized access to telecom OSS/BSS management interfaces and provisioning systems.
  • Custom implants targeting HLR/HSS; rogue SS7 gateways or signaling firewall bypass.
  • Stolen administrative credentials for telecom provisioning systems.

• Threat Group Profile: SilentAir

  • State-linked advanced persistent threat focused on APAC telecommunications.
  • C2 infrastructure uses DNS tunneling and encrypted traffic over ports 443/8443.
  • Targets thousands of mobile subscribers; exact victim count remains TBD.
  • Research attributed to Redside Security and CERT-TW.

• Indicators and Defensive Actions

  • Monitor SS7/SIGTRAN MAP/TCAP anomalies and unauthorized HLR/HSS queries.
  • Audit telecom OSS/BSS administrative credentials and provisioning access.
  • Deploy signaling firewalls; block rogue SS7 gateways.
  • Migrate high-value accounts from SMS 2FA to phishing-resistant MFA (FIDO2, authenticator apps).

• Conclusion

  • SilentAir confirms SMS 2FA is ineffective when carrier signaling infrastructure is compromised.
  • Immediate telecom signaling hardening and MFA migration required for high-value targets.