China-Linked Fire Ant Expands Campaign to Compromise Cisco Routers, Steal Credentials
A China-nexus threat actor known as Fire Ant has broadened its cyber espionage operations to target Cisco IOS XR routers and TACACS servers, aiming to steal credentials and disable security logging.
A sophisticated cyber espionage campaign attributed to a China-nexus actor, tracked as Fire Ant, has evolved beyond its previous focus on VMware environments. The group is now actively compromising Cisco IOS XR routers and Terminal Access Controller Access-Control System (TACACS) servers, along with associated Linux management hosts. These devices are critical for network routing, authentication, and overall management of high-value networks, making them prime targets for espionage.
Incident response firm Sygnia detailed how Fire Ant leverages these compromised network devices as collection platforms. The attackers capture sensitive network traffic, harvest user credentials, and crucially, suppress logging and telemetry data. This deliberate disabling of security logs hinders defenders' ability to reconstruct attack timelines and identify malicious activity, providing the attackers with a significant operational advantage.
The primary objective appears to be maintaining long-term access and exfiltrating sensitive data from targeted organizations. While the group has explored paths into connected high-value environments, including critical infrastructure, Sygnia's investigation indicated that activity against these specific networks was limited to scanning and connection attempts rather than confirmed breaches. The control over routers provides the actor with a privileged perspective over network traffic flowing through trusted paths.
Sygnia noted strong overlaps between this activity and previously reported campaigns attributed to UNC3886, a China-nexus espionage group known for targeting virtualization platforms and network edge devices. However, the firm stopped short of a definitive attribution. The current campaign follows Sygnia's July 2025 disclosure of Fire Ant's exploitation of VMware ESXi and vCenter environments, demonstrating a clear progression in the actor's targeting strategy.
The investigation was triggered by an anomaly on a Cisco IOS XR router, specifically an unauthorized Generic Routing Encapsulation (GRE) tunnel interface with no configuration history. Tracing this tunnel led investigators to a legacy Linux system from which Fire Ant conducted extensive port probing against administrative and service ports on connected networks. The router malware itself was purpose-built for the IOS XR control plane, featuring a modified system library designed to filter outgoing log messages, forwarding only those containing the string "Health," and altering command execution paths to hide the attacker's tunnel configuration.
Fire Ant employed the compromised routers to capture packet data (PCAPs) from multiple Cisco devices, uploading them to external FTP servers. On the TACACS server, the group deployed a new credential-collection toolset dubbed TacTap. This involved injecting a malicious library into the running tac_plus authentication process, which hooked connection functions and passed session handles to a secondary process. Captured credentials were then written to a file and obfuscated using a single-byte XOR key.
This specific library-injection technique for TACACS servers represents a notable evolution in Fire Ant's tradecraft, building upon known methods used by groups like UNC3886 to sniff credentials or replace the tac_plus daemon with a backdoored version. In addition to TacTap, Sygnia discovered a new Linux backdoor named BridgeAgent, masquerading as a Zabbix monitoring agent. This implant established command-and-control over TLS on port 443, polling attacker infrastructure for instructions and reverse-shell capabilities.
To ensure persistent access and evade detection, Fire Ant deployed a range of tools on Linux management hosts, including custom SSH backdoors, open-source rootkits like Medusa and REPTILE, and binaries disguised as legitimate endpoint security agents from SentinelOne and Cybereason. The actor also actively worked to undermine forensic evidence by suppressing logs, disabling security features like SELinux, and rewriting system records. Sygnia emphasizes the importance of treating routers, TACACS servers, and other network infrastructure as critical forensic assets, validating logs against multiple evidence sources rather than relying on a single telemetry stream.