Spy group intercepted calls and messages on telecommunications networks in Asia
Enea details the SilentAir campaign targeting Asian telecom infrastructure, focusing on SS7 and Diameter signaling manipulation for call and SMS interception, including 2FA code capture. How the attacks work
Enea details the SilentAir campaign targeting Asian telecom infrastructure, focusing on SS7 and Diameter signaling manipulation for call and SMS interception, including 2FA code capture.
How the attacks worked
The group used the same ways that mobile phone networks worldwide communicate with each other, through specific technical protocols. The perpetrators sent false signals so that the network system would "believe" that the user's communication should be directed to their own equipment.
To ensure that the call and message diversion was working, they sent βsilent SMSβ messages, which do not appear on the userβs screen. According to security firm Enea, which detected their activity, the interception of messages was often done to extract login confirmation codes. This allowed the perpetrators to try to gain access to their targetsβ accounts, although it has not been confirmed whether they actually managed to hack specific personal accounts.
The activity and identity of the perpetrators
Enea has identified SilentAir's activity in at least six Asian countries. The group is considered professional and possibly linked to state interests. One indication of its origin was its activity schedule, as attacks stopped on weekends and during Chinese holidays. Despite this evidence, the connection to China has not been confirmed and remains an assessment with low certainty.
β³
READ ALSO
HACKS.GR / RELATED
Cyber ββAttacks & Data Breaches
Microsoft: Services gradually restored in Asia after technical problems
β
Furthermore, SilentAir's traces do not indicate direct collaboration with other known groups, such as Liminal Panda. Enea has already informed the telecommunications providers where the sources of the attack were identified, with the group's activity now stopped.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
β
end of article
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.