[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPnFuEXcNLkF9M4bgBFNtddw8pinThVy-E3EnnIgV0Jw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"3bc79979-6505-4e58-a98d-270d03576656","state-actors-exploit-telecom-protocols-to-intercept-calls-and-sms-at-network-level","8b24353b-4898-4d44-8cfd-070a5f4916c7","State Actors Exploit Telecom Protocols to Intercept Calls and SMS at Network Level","SilentAir and Liminal Panda demonstrate that state-level threat actors are actively compromising mobile operator infrastructure by exploiting legacy signaling protocols — SS7, Diameter, and GTP — that were designed for trust-based interconnect environments, not adversarial ones. By hijacking network nodes and leveraging the IPX interconnect network, attackers can silently intercept calls and SMS messages without touching end-user devices, making detection extremely difficult. These protocols were built decades ago with the assumption that only legitimate carriers would participate, leaving them fundamentally vulnerable to abuse by any actor who can reach the network layer. The scale of harm is significant: targeted subscribers have no visibility into the interception, and sensitive communications including authentication codes transmitted via SMS are exposed. This incident underscores why telecom infrastructure must be treated as critical national security infrastructure with rigorous access controls and monitoring.","**Immediate actions:**\n- Deploy SS7 and Diameter firewalls with anomaly detection rules to block unauthorized location tracking and call interception commands from unexpected network peers.\n- Audit all IPX and roaming partner connections to verify that only trusted, authenticated network nodes can send signaling messages into the core network.\n- Restrict GTP traffic at network boundaries so that only known, authorized GGSN\u002FSGW endpoints can establish tunnels.\n\n**Long-term improvements:**\n- Migrate SMS-based authentication (OTP) to app-based or hardware token MFA to reduce the value of intercepted SMS messages.\n- Implement zero-trust principles for inter-carrier interconnects, requiring mutual authentication and strict allowlisting of signaling message types.\n- Engage in threat intelligence sharing through telecom industry bodies (e.g., GSMA) to receive early warning of signaling abuse patterns.\n\n**Detection measures:**\n- Deploy continuous signaling traffic monitoring with behavioral baselines to detect anomalous SS7\u002FDiameter message flows indicative of subscriber tracking or interception.\n- Establish a dedicated telecom security operations capability with alerting on unusual roaming queries, MAP SRI requests, and GTP tunnel creation from unexpected sources.\n- Conduct regular third-party red team assessments of signaling infrastructure to identify exploitable paths before attackers do.",[12,13,14,15,16],"MITRE ATT&CK T1557: Adversary-in-the-Middle","NIST SP 800-53 SC-8: Transmission Confidentiality and Integrity","CIS Control 12: Network Infrastructure Management (v8)","NIS2 Article 21(2)(i)","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events",{"NIS2 Article 21(2)(i)":18,"MITRE ATT&CK T1557: Adversary-in-the-Middle":19,"CIS Control 12: Network Infrastructure Management (v8)":20,"NIST SP 800-53 SC-8: Transmission Confidentiality and Integrity":21,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":22},"This point covers access control and asset management for critical infrastructure; enforcing strict access controls over who can send signaling commands through carrier interconnect networks is the core gap SilentAir exploited.","SilentAir exploits SS7 and Diameter protocol trust to position itself between subscriber communications and legitimate network nodes, intercepting calls and SMS in transit.","This control requires secure management and monitoring of network infrastructure; hardening and monitoring of SS7\u002FDiameter interconnect nodes would have constrained the attackers' ability to hijack network signaling paths.","This control requires protecting the confidentiality and integrity of transmitted information; the absence of such protections on SS7\u002FDiameter\u002FGTP signaling channels is precisely what SilentAir exploits.","Continuous monitoring of SS7, Diameter, and GTP traffic for anomalous signaling patterns would be the primary technical means to detect SilentAir's interception activity before large-scale data harvesting occurs.","published","2026-11-13T13:22:35.979888+00:00","2026-11-13T13:22:35.957+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fsilentair-hackers-intercept-calls-sms-from-inside-mobile-networks\u002F","silentair-hackers-intercept-calls-sms-from-inside-mobile-networks-76848e","SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[45,49,53],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":54,"name":55,"problem":56},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]