Fire Ant Expands Cyber Espionage Campaign to Cisco Routers and TACACS Servers
A China-linked cyber espionage group tracked as Fire Ant has broadened its long-running campaign, shifting from VMware hypervisors to target Cisco IOS XR routers, TACACS servers, and Linux management hosts in high-value networks. The intrusion, investigated by incident response firm Sygnia, revealed the threat actor’s use of compromised routers as collection platforms to capture network traffic, harvest credentials, and suppress logging effectively blinding defenders to their activities.
Fire Ant leveraged its access to scan and probe connected environments, including critical infrastructure, though confirmed breaches beyond initial footholds remain unproven. By controlling routers, the group gained persistent visibility over trusted network traffic, enabling reconnaissance and lateral movement. Sygnia noted that the activity strongly aligns with UNC3886, a China-nexus espionage group known for targeting virtualization and edge devices, though no definitive attribution was made. Mandiant, which first documented UNC3886, found no technical overlap with other Chinese operations like Salt Typhoon or Volt Typhoon.
The campaign’s origins trace back to July 2025, when Sygnia disclosed Fire Ant’s exploitation of VMware ESXi and vCenter environments. The latest activity, detected in 2026, began with an anomaly on a Cisco IOS XR router a Generic Routing Encapsulation (GRE) tunnel with no configuration history. Investigators traced the tunnel to a legacy Linux system, where Fire Ant conducted port probing (SSH, HTTP, SMB, RDP) and connection attempts against administrative services.
The group deployed custom malware tailored for IOS XR, including a modified system library that filtered logs to hide its presence. Another component altered command execution paths, appending | exclude filters to conceal the attacker’s tunnel configuration. Fire Ant also captured packet data (PCAPs) from multiple Cisco devices, uploading them to external FTP servers set up the same day.
On TACACS servers, Sygnia identified TacTap, a novel credential-collection tool. The malware injected a malicious library into the tac_plus authentication process, intercepting live session handles and writing stolen credentials to /var/log/.tacplus.acct with a single-byte XOR obfuscation (0xEF). This technique, previously undocumented, represents an evolution in Fire Ant’s tradecraft, building on past TACACS+ sniffing tools like LOOKOVER.
Additional tools included BridgeAgent, a Linux backdoor disguised as a Zabbix monitoring agent, persisting via a systemd service and communicating over TLS on port 443. The group also deployed rootkits (Medusa, REPTILE), custom SSH backdoors, and impersonated security agents (SentinelOne, Cybereason) to maintain access. Some backdoors remained active in memory even after file deletion.
Fire Ant further obfuscated its tracks by suppressing router logs, SNMP traps, and authentication requests; disabling SELinux; and altering login histories. Sygnia emphasized the need to treat routers, TACACS servers, and hypervisors as critical forensic assets, recommending cross-validation of logs with memory, disk, and network evidence.
Indicators of compromise (IoCs) include:
- TacTap: Injector (
/usr/sbin/acppid), malicious library (/lib/libseconfd.so), credential file (/var/log/.tacplus.acct). - BridgeAgent: Persistence via
zabbix_agent.service, encrypted config (/opt/.ICEauthority), C2 over TLS (port 443). - IOS XR implants:
/usr/bin/acpid,/pkg/bin/dhcpd_show_issu_status,/pkg/bin/hd, and persistence script/etc/rc.d/init.d/grub-rommon. - VMCI backdoor:
/var/tmp/audit, communicating via VMware’s Virtual Machine Communication Interface. - Packet-triggered backdoor:
/var/tmp/ping, activated by specific TCP/UDP ports and the stringsxcdewqaz!@#.
The campaign mirrors Salt Typhoon’s 2025 router-based credential harvesting, underscoring a broader trend of Chinese espionage groups targeting network edge devices for persistent access and intelligence collection.
Source: https://thehackernews.com/2026/08/china-linked-fire-ant-hijacks-cisco.html
Cisco cybersecurity rating report: https://www.rankiteo.com/company/cisco
"id": "CIS1788172042",
"linkid": "cisco",
"type": "Cyber Attack",
"date": "7/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'type': 'High-value networks, critical '
'infrastructure'}],
'attack_vector': ['Exploitation of Cisco IOS XR routers',
'TACACS servers',
'Linux management hosts',
'VMware ESXi and vCenter'],
'data_breach': {'data_exfiltration': 'Uploaded to external FTP servers',
'file_types_exposed': ['PCAPs'],
'sensitivity_of_data': 'High (credentials, network traffic)',
'type_of_data_compromised': ['Network traffic',
'Credentials',
'Packet data (PCAPs)']},
'date_detected': '2026',
'description': 'A China-linked cyber espionage group tracked as Fire Ant has '
'broadened its long-running campaign, shifting from VMware '
'hypervisors to target Cisco IOS XR routers, TACACS servers, '
'and Linux management hosts in high-value networks. The '
'intrusion involved using compromised routers as collection '
'platforms to capture network traffic, harvest credentials, '
'and suppress logging. Fire Ant leveraged its access to scan '
'and probe connected environments, including critical '
'infrastructure, though confirmed breaches beyond initial '
'footholds remain unproven.',
'impact': {'data_compromised': ['Network traffic',
'Credentials',
'Packet data (PCAPs)'],
'operational_impact': 'Persistent visibility over trusted network '
'traffic, reconnaissance, and lateral '
'movement',
'systems_affected': ['Cisco IOS XR routers',
'TACACS servers',
'Linux management hosts',
'VMware hypervisors']},
'initial_access_broker': {'backdoors_established': ['BridgeAgent',
'Medusa rootkit',
'REPTILE rootkit',
'Custom SSH backdoors'],
'entry_point': ['Cisco IOS XR routers',
'Legacy Linux systems'],
'high_value_targets': 'Administrative services '
'(SSH, HTTP, SMB, RDP)'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Routers, TACACS servers, and hypervisors should be '
'treated as critical forensic assets. Cross-validation of '
'logs with memory, disk, and network evidence is essential '
'to detect sophisticated threats.',
'motivation': 'Espionage, Intelligence Collection',
'post_incident_analysis': {'corrective_actions': ['Patch and harden Cisco IOS '
'XR routers and TACACS '
'servers',
'Remove or isolate legacy '
'Linux systems',
'Deploy enhanced monitoring '
'for edge devices',
'Implement memory and disk '
'forensics for critical '
'assets'],
'root_causes': ['Exploitation of unpatched or '
'misconfigured Cisco IOS XR '
'routers',
'Compromised legacy Linux systems',
'Use of custom malware and '
'rootkits to maintain '
'persistence']},
'recommendations': ['Treat routers, TACACS servers, and hypervisors as '
'critical forensic assets',
'Cross-validate logs with memory, disk, and network '
'evidence',
'Monitor for unusual GRE tunnels or unconfigured network '
'changes',
'Enhance detection of custom malware and rootkits on edge '
'devices'],
'references': [{'source': 'Sygnia'}, {'source': 'Mandiant'}],
'response': {'containment_measures': ['Cross-validation of logs with memory, '
'disk, and network evidence',
'Treatment of routers, TACACS servers, '
'and hypervisors as critical forensic '
'assets'],
'third_party_assistance': 'Sygnia (incident response firm)'},
'threat_actor': 'Fire Ant (aligned with UNC3886, China-nexus)',
'title': 'Fire Ant Expands Cyber Espionage Campaign to Cisco Routers and '
'TACACS Servers',
'type': 'Cyber Espionage'}