SilentAir and LIMINAL PANDA: Exploiting SS7, Diameter, and GTP-U Through Compromised Telecommunication Operators

1. Basic Information

• Article Title: The Enemy Within: Tracking LIMINAL PANDA and SilentAir Through Mobile Networks
• Publisher: Enea
• Publication Date: 2026-11-11
• Updated Date: 2026-11-12
• Collection Date: 2026-11-14T08:00:43+09:00
• Original Source: Enea
• Related Sources: SecurityWeek: Chinese Hackers Exploit Cellular Protocols
• Related Malware: GTPDoor v3
• Related Threat Actors: SilentAir, LIMINAL PANDA
• Related CVE: None
• Related Products and Technologies: SS7, Diameter, GTP-U, IPX
• Author-assessed Response Priority: Critical (editorial assessment; not a vendor severity rating or CVSS score).
• Response Priority Rationale: The actors abused trusted signaling paths within telecom operators, affecting subscriber location data, SMS, and voice communications across multiple countries. For some targets, 2FA codes were received immediately after interception began. Enea assesses that this suggests an intent to compromise other accounts, but use of the codes and successful authentication have not been publicly confirmed.

2. Executive Summary

Enea analyzed SilentAir, which injects unauthorized signaling from compromised telecom operator nodes into IPX, and LIMINAL PANDA, which uses GTPDoor v3. The report details in-network attacks leading to location tracking, information gathering, and the interception of SMS and voice communications.

3. Attack Flow

SilentAir Signaling Abuse

1. Compromise a telecom operator node.
2. Inject SS7 or Diameter messages into the IPX from a trusted operator path.
3. Query subscriber information and location.
4. Modify subscriber location registration using malicious SS7 UpdateLocation or Diameter Update-Location-Request messages, redirecting subsequent SMS and voice traffic to the interception path.
5. Enea assesses that the interception suggests an intent to use the captured 2FA codes and information to compromise other accounts. However, use of the codes and successful authentication have not been publicly confirmed.

LIMINAL PANDA GTPDoor (GTP-C)

1. Deploy GTPDoor on a Linux system within the telecom operator network.
2. Receive covert commands via GTP-C packets and attempt C2 communications.
3. Establish a GTP-U tunnel to send commands to other nodes, steal information, or perform C2 communications, and terminate the tunnel and malware upon completion.

LIMINAL PANDA GTPDoor v3 (GTP-U)

1. Deploy GTPDoor v3 on a Linux system within the telecom operator network.
2. Monitor GTP-U packets using libpcap to receive covert commands.
3. Conceal C2 within legitimate mobile protocols and persist within the operator network.

4. Attacker Positioning and Execution Location

• An advanced remote actor with access to telecom operator nodes or IPX peers.

5. Visibility for Victims and Administrators

Victim Side

• May appear as delayed SMS, call anomalies, or suspicious logins immediately following the receipt of a 2FA code (Inference: Not confirmed as an observed symptom in primary sources; this is a candidate correlation between subscriber-side experiences and IdP logs, requiring cross-referencing with operator-side signaling records).

Administrator Side

• May appear as anomalous subscriber queries, GTP-U payloads, or suspicious logins immediately following the receipt of a 2FA code (Inference: Not confirmed as an observed symptom in primary sources; this is a candidate correlation among operator, IPX, and IdP logs). Additionally, because compromised legitimate operator nodes can act as the source, signaling from known legitimate peers should also be monitored.

6. Success and Failure Conditions

Success Conditions

• [SilentAir] Ability to send signaling from a compromised operator node to the IPX.
• [SilentAir] Ability to identify the target subscriber.
• [SilentAir] Insufficient signaling firewall or peer validation controls.
• [LIMINAL PANDA (GTP-C)] Ability to execute GTPDoor on a compromised Linux host and receive GTP-C.
• [LIMINAL PANDA (GTP-C)] Covert commands within GTP-C reach GTPDoor without being detected or blocked.
• [LIMINAL PANDA (GTPDoor v3 / GTP-U)] Ability to execute GTPDoor v3 on a compromised Linux host and receive GTP-U.
• [LIMINAL PANDA (GTPDoor v3 / GTP-U)] Covert commands within GTP-U reach GTPDoor v3 without being detected or blocked.

Failure Conditions and Mitigations

• [Prevention Condition] Isolate operator nodes from IPX peers, and validate sources, commands, and rates.

7. Impact Upon Success

• Acquisition of subscriber locations and identification data.
• Interception of SMS and voice traffic, including 2FA codes. Enea assesses that this suggests an intent to compromise other accounts, but use of the codes and successful authentication have not been publicly confirmed.
• Covert persistence within the telecom operator network.

8. Observable Logs

• Email: None specified
• Proxy, SWG, and DNS: None specified
• Endpoint and EDR: None specified
• Identity and IdP: Logins from unknown devices or locations immediately following the receipt of an SMS OTP (Inference: Not observed in primary sources; this is a candidate correlation between IdP logs and operator-side signaling records).
• SaaS and Cloud: None specified
• Network: Abnormal SS7 or Diameter subscriber queries, SMS/voice rerouting, and suspicious payloads within GTP-U.

9. Attack Success Determination

Because the execution sequence and cooperative relationship between SilentAir and LIMINAL PANDA remain unconfirmed, success determinations are separated by actor, with LIMINAL PANDA further divided by its GTP-C and GTPDoor v3 (GTP-U) pathways.

Information Theft or Session Compromise Confirmed

• Target: SilentAir
• Public Information: Enea confirmed the interception of location, SMS, and voice data. In some targets, 2FA codes were received shortly after interception. Enea evaluates that this suggests an intent to compromise other accounts, but code usage and successful authentication have not been publicly confirmed.
• Scope of Confirmation: SilentAir, SS7/Diameter, and the communication signaling and target cases monitored by Enea.

LIMINAL PANDA (GTP-C): GTPDoor C2 Attempts and Infection Confirmed

• Target: LIMINAL PANDA (GTP-C)
• Public Information: Hundreds of covert C2 attempts were detected and blocked on GTP-C, and direct observation or strong indicators of GTPDoor infections were confirmed for at least 5 to 10 operators. However, successful command execution or information theft has not been confirmed for the blocked attempts.
• Scope of Confirmation: LIMINAL PANDA, GTP-C, and the telecom operator networks monitored by Enea. The evidence concerning infections at 5 to 10 operators comes from GTP-C observations; this figure must not be treated as a GTPDoor v3 infection count.

LIMINAL PANDA (GTPDoor v3 / GTP-U): Existence of New Version and Corresponding Samples Confirmed

• Target: LIMINAL PANDA (GTPDoor v3 / GTP-U)
• Public Information: The existence of GTPDoor v3, which utilizes GTP-U, and Linux samples corresponding to GTP-U behaviors were confirmed. Enea reports that LIMINAL PANDA uses v3 and believes that it is deployed primarily as a backup when other methods are blocked. Neither the number of operators infected via v3 nor individual execution success has been confirmed.
• Scope of Confirmation: LIMINAL PANDA, GTPDoor v3/GTP-U, Enea's investigations, and samples confirmed on VirusTotal.

10. Investigation Playbook

• Investigation Triggers: Subscriber queries from unknown peers, SMS rerouting, and GTP-U anomalies.
• Initial Checks: Identify the source operator, subscriber, timestamp, signaling command, and roaming paths.
• Endpoint Investigation: Preserve processes, binaries, libpcap usage, and credentials on operator nodes. Preserve authentication and access logs for operator node management interfaces, and check for abnormal authentication or access.
• Identity and Cloud Investigation: Check sessions and credentials for accounts where 2FA codes were used.
• Investigation Expansion: Expand to other subscribers from the same source, voice/SMS routes, and IPX peers.
• Containment: Block peers, isolate nodes, rotate keys/credentials, and strengthen MFA.
• Classification: Differentiate among signaling reconnaissance, interception, 2FA abuse, and operator compromise.

11. Defense and Detection Ideas

• Individual Events: Abnormal location queries, SMS forwarding, and GTP-U packet patterns. Audit subscriber lookups and SMS/voice rerouting as high-risk events.
• Event Correlation: Correlate signaling queries -> SMS reception -> external logins on a per-subscriber basis.
• Threat Hunting: Search for new peers, abnormal rates, nighttime subscriber queries, and GTPDoor lineage.
• Logging Gaps: Subscriber-side logs alone are insufficient; timestamp synchronization across operator, IPX, and IdP systems is required.
• Priority Controls: Prioritize signaling firewalls, peer validation, and reducing SMS MFA dependency. Migrate critical accounts from SMS-based MFA to phishing-resistant MFA. Note that this mitigates authentication compromises using stolen codes, rather than preventing SMS interception or location tracking directly.

12. Facts, Inference, and Hypothesis

Facts

• SilentAir injected SS7 and Diameter signaling from compromised telecom operator nodes into the IPX, utilizing operators in at least six Asian countries as attack sources.
• Targets spanned at least 12 countries and territories, with Taiwan as the primary target.
• Enea confirmed location tracking, information gathering, and SMS/voice interception, observing that 2FA codes were received shortly after interception in some targets. Enea evaluates that this suggests an intent to compromise other accounts, but code usage and successful authentication have not been publicly confirmed.
• Enea evaluates with high confidence that SilentAir is a state-level actor, and with low confidence assesses a connection to China. This does not directly indicate Chinese government involvement.
• For LIMINAL PANDA, hundreds of covert C2 attempts were detected and blocked on GTP-C, with direct observations or strong indicators of infection confirmed for at least 5 to 10 operators. Enea noted that dozens of operators globally could potentially be affected.
• GTPDoor v3 utilizes GTP-U and libpcap while sharing the same XOR family as older versions. Enea views v3 as being deployed primarily as a backup when other methods are blocked. No connection to SilentAir has been confirmed.

Inference

• Because legitimate protocols within the telecommunications network are used, detection and root-cause analysis are difficult using subscriber-side telemetry alone.

Hypothesis

• No additional hypotheses

13. MITRE ATT&CK Mapping

14. Uncertainties and Additional Investigation

• Whether SilentAir and LIMINAL PANDA share the same identity or a cooperative relationship, the total number of compromised operators, and the scope of successful interception across targets remain unconfirmed.

15. Impact on SOCs and Organizations

Telecom operators and organizations that use international roaming should prioritize SS7/Diameter/GTP source validation, IPX peer monitoring, and reducing reliance on SMS for 2FA.

16. Summary by Target Audience

• For SOCs: Correlate abnormal subscriber lookups, SMS routing, Diameter commands, and GTP-U C2 patterns using operator telemetry.
• For Administrators: Strengthen IPX peer allow-lists, signaling firewalls, and source validation for roaming paths.
• For Users: Do not rely solely on SMS authentication for high-risk accounts; utilize passkeys or hardware keys instead.