The China-nexus threat actor Fire Ant has moved down the stack. According to new research from Sygnia, the group has escalated from virtualization platforms to the trusted network infrastructure underneath them — compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts to harvest credentials, collect traffic, and systematically destroy the evidence defenders would use to find them.

Sygnia’s framing is the sharpest line in the report: “When a threat actor controls routers, they do not only gain reach. They gain perspective.”

How the intrusion was found

The discovery came from an anomaly that should not have existed. Investigators found an active GRE tunnel interface on a Cisco IOS XR router that could not be explained by the running configuration or the commit history.

That is a meaningful detail on its own. The tunnel was live and passing traffic, but the device’s own configuration state and change history gave no account of it. The router was lying about itself.

From there, Sygnia mapped a toolkit built specifically for hiding inside network infrastructure.

The implants

TacTap — a TACACS-focused credential harvesting implant. It injects malicious code into the TACACS authentication process, capturing credentials as they are validated and storing them with basic XOR obfuscation.

TACACS+ is the protocol that centralizes administrative authentication and authorization for network devices. An implant sitting inside the TACACS process does not need to crack anything or phish anyone — it simply reads every network administrator credential in the environment as those administrators log in, in the normal course of their work. It is the network-device equivalent of an implant inside a domain controller’s authentication path.

BridgeAgent — a Linux backdoor masquerading as Zabbix monitoring software. Zabbix is standard infrastructure monitoring, running on management hosts, talking to everything, and generating constant network activity that nobody looks at twice. A backdoor wearing that costume is close to invisible in traffic analysis.

Custom IOS XR implants — router-resident malware that modifies system libraries to filter logging output.

The evidence suppression is the point

The most operationally significant part of Sygnia’s findings is not any single tool. It is that Fire Ant systematically attacked the sources of truth defenders depend on:

  • Suppressed router logging
  • Altered command output — so an administrator running a diagnostic command on a compromised router gets a clean, false answer
  • Captured administrative credentials
  • Tampered with host logs
  • Disabled SELinux
  • Removed audit trails
  • Deployed multiple persistent backdoors for redundancy

Command output manipulation deserves particular attention. Most network incident response begins with an engineer SSH-ing into a device and running show commands. If the device has been instructed to lie about its own interfaces, routes, and processes, that entire investigative method returns nothing — and returns it confidently. The hidden GRE tunnel was found in spite of this, not because of it.

This is why network device compromise is so persistent. There is no EDR agent on an IOS XR router. There is no independent telemetry source. The device reports on itself, and Fire Ant has made the device an unreliable narrator.

Attribution and lineage

Sygnia assesses that this activity overlaps significantly with UNC3886, the Chinese espionage cluster known for targeting virtualization platforms — VMware ESXi hypervisors, vCenter — and network edge devices, and for exploiting zero-days in those products. Sygnia notes the overlap does not constitute definitive attribution.

The progression from hypervisors to routers and authentication infrastructure is coherent as a strategy. Both target layers share the same property: they sit beneath the systems that security tooling monitors. An implant on a hypervisor is invisible to every guest VM’s EDR. An implant on a router is invisible to everything. The actor is choosing positions where the defensive stack structurally cannot see.

The stated objective in Sygnia’s reporting is also worth noting: Fire Ant used compromised routers to explore other access points with the goal of spreading to other organizations. This is infrastructure being used as a bridge between victims — the same supply-chain-by-connectivity logic that made Salt Typhoon’s telecom router campaign so consequential.

What defenders can actually do

Router security advice tends toward the useless because the tooling does not exist. These are the ones that work:

Reconcile device configuration against an external source of truth. The GRE tunnel was found because someone compared what the interface table showed against what the configuration and commit history justified. Do this systematically. Any interface, tunnel, route, or ACL entry that does not map to an approved change record is an incident until proven otherwise.

Ship network device logs off-box in real time. A compromised device can suppress its own local logging. It has a much harder time retroactively editing what has already been transmitted to an external syslog collector. Alert on logging volume dropping — a router that suddenly gets quiet is a router with a problem.

Monitor TACACS servers as tier-zero. They are identity infrastructure for the network estate and are almost never classified that way. Process integrity monitoring on the TACACS daemon, file integrity monitoring on its binaries and libraries, and alerting on unexpected process injection all apply here.

Verify image integrity out of band. Cisco provides signed image verification and, on supported platforms, boot integrity visibility. Use it, and validate results from a management path that does not depend on the device being honest.

Audit your Zabbix estate. BridgeAgent impersonates it. Confirm that every Zabbix agent and proxy process on your management hosts corresponds to a deployment you made, from a package you installed, at a path you expect.

Segment management networks properly. Fire Ant’s chain runs from routers to TACACS to Linux management hosts to connected high-value environments. That chain requires reachability at every hop. Out-of-band management networks exist to break it, and most organizations have one on the diagram and not in the routing table.

Assume credential compromise across the network estate. If TACACS was in scope, every network administrator credential that authenticated during the dwell period should be considered captured.

Sources