Fire Ant Moves From Hypervisors to Cisco Routers

Sygnia, the company that investigated the incident, has reported a new phase in a long-running campaign by the group it tracks under the name Fire Ant. Where the attackers previously confined themselves to the VMware ESXi and vCenter virtualization platforms (Sygnia wrote about this back in July 2025), they have now descended to the network and management layer — to Cisco IOS XR routers, TACACS authentication servers and Linux administration hosts.

The Router as an Observation Post

The compromised routers were turned into data-collection platforms: intercepting traffic, harvesting credentials and suppressing the very telemetry that defenders later rely on to reconstruct the course of an attack. “By controlling the routers, the attacker gains not just access but visibility,” the analysts put it.

The investigation began with an anomaly: an IOS XR router was found to have a GRE tunnel that had neither a configuration nor a commit history to explain its appearance. Exactly how the attackers gained their initial access could not be established. The malware was written specifically for the IOS XR management plane: one component replaced a system library and let through only those log messages containing the string Health, while another appended a | exclude filter to show commands, hiding the tunnel from administrators.

Stealing Passwords and Covering Tracks

On the TACACS server, a toolset dubbed TacTap was discovered: an injector loaded a malicious library into the tac_plus authentication process, intercepted connections and stored the captured credentials in a file, /var/log/.tacplus.acct, lightly “encrypted” with a single-byte XOR key. According to Sygnia, this particular technique for injecting into the tac_plus library had not previously been described publicly.

Among the other findings was a Linux backdoor, BridgeAgent, which posed as a Zabbix monitoring agent and disguised its process as gnome-shell. To maintain a persistent presence on Linux hosts, Fire Ant used the open-source rootkits Medusa and REPTILE, its own SSH backdoors, and binaries renamed and forged to impersonate the SentinelOne and Cybereason agents. One of the backdoors kept running in memory even after its file had been deleted from disk.

The attackers paid particular attention to destroying evidence: they disabled router logs, SNMP traps and authentication records, turned off SELinux, rewrote login histories and scrubbed the logs of any mention of privileged commands.

Who Is Behind It

Sygnia notes a strong overlap in activity with the known group UNC3886, though it stops short of a definitive attribution. The company stresses that routers, TACACS servers, hypervisors and jump hosts must be treated as full-fledged forensic objects, and that logs should be cross-checked against data from memory, disk, network and configurations rather than relying on a single source of telemetry. A similar signature — intercepting router traffic and TACACS+ — was previously attributed to another Chinese group, Salt Typhoon.

Source: The Hacker News