Fire Ant, a cyber espionage group with ties to China, has escalated its operations by compromising Cisco IOS XR routers, TACACS servers, and Linux management hosts—systems used by critical and high-value networks. The campaign, uncovered by incident response team Sygnia, reveals Fire Ant turned these routers into tools for traffic capture, credentials theft, and deliberate log tampering to evade detection.
How the Compromise Unfolded
The investigation began when Sygnia noticed a Generic Routing Encapsulation (GRE) tunnel on a Cisco IOS XR router that had no record of being configured. Tracing that anomaly led to a Linux host Firefox Ant leveraged to probe and attack other connected administrative systems, including SSH, SMB, HTTP, and RDP services.
On the router control plane, Fire Ant deployed malware tailored to IOS XR. One module filtered outgoing logs, forwarding only those containing the word “Health.” Another altered command execution paths to conceal the tunnel configuration by adding filters so administrators inspecting the routes wouldn’t see malicious setup.
Tools, Credential Harvesting & Persistence
Credential theft was extensive. Sygnia identified a novel toolset named TacTap on TACACS servers, involving a malicious library injected into the tac_plus authentication service. Fire Ant hooked into the code that accepted new connections and siphoned off credential data into a file—lightly obscured by a single-byte XOR key.
Another implant, BridgeAgent, posed as a Zabbix monitoring agent while providing remote access through TLS. Fire Ant also made use of rootkits, custom SSH backdoors, and binaries masquerading as legitimate security agents. These tools enabled persistence, even after deletion of files on disk.
Efforts to Hide and Importance of Forensic Depth
Log suppression featured heavily in the attack. The group disabled SELinux, cleaned login history, altered records of administrative actions, and removed privileged command entries. Fire Ant even tampered with SNMP traps and authentication request logs.
Sygnia warns that routers, management hosts, hypervisors, and jump boxes should always be considered vital forensic assets. Analysts should cross-check logs from memory, network, disk, authentication, and configuration sources—not just rely on one telemetry stream.
IoCs from the intrusion include specific file paths, injected library filenames, hash values of components, persistence scripts, and network triggers. These range from implants like acppid to backdoors active over VMware’s VMCI sockets, and dummy services using legitimate names to mask malicious activity.
Analysts assessed Fire Ant’s tactics overlap significantly with the group known as UNC3886, previously identified targeting virtualization environments and network-edge infrastructure. Still, attribution remains non-definitive. Fire Ant has been observed operating since mid-2025.
This operation resembles earlier threats, such as those attributed to Salt Typhoon—a Chinese espionage group observed collecting packet-level traffic and administrator credentials in telecom networks by compromising routers.
The campaign’s new phase shows Fire Ant’s expanding focus into infrastructure components that facilitate wide-reaching visibility and control.
Analysis:Fire Ant’s breach marks a sharp escalation from its prior focus on virtualization platforms. By subverting Cisco routers and TACACS servers, it gains both access to credential data and effective cloaking capabilities. Networks must reassess which devices are considered trust anchors—especially those that have long been overlooked in incident response plans. Going forward, monitoring suppliers’ updates for IOS XR, bolstering authentication systems, and enhancing multi-source logging practices will be critical defenses.
