Fire Ant Goes Deeper: China-Linked Hackers Hit Cisco Routers, TACACS Servers and Linux Hosts
A China-linked espionage group known as Fire Ant has significantly broadened its attack surface, moving well beyond VMware infrastructure to compromise Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. Incident response firm Sygnia documented the intrusion and found the attackers had turned this hardware into a quiet surveillance platform, siphoning credentials, capturing traffic, and systematically dismantling the logging infrastructure defenders depend on.
The group's position on the routers wasn't just about access. Controlling devices that sit in the path of trusted network traffic gives an attacker visibility that endpoint monitoring simply can't replicate. As Sygnia put it, the actor didn't only gain reach, they gained perspective. From those vantage points, Fire Ant probed connected high-value environments, including what Sygnia described as critical infrastructure, though scanning and connection attempts appear to be as far as that activity went.
Sygnia assessed the campaign strongly overlaps with UNC3886, a Chinese espionage cluster previously documented by Mandiant for targeting network edge devices and virtualisation platforms. Mandiant has separately noted that UNC3886 does not appear to share technical lineage with Salt Typhoon or Volt Typhoon, the two other Chinese operations that have attracted significant attention in recent years.
The investigation started with something odd on a Cisco IOS XR router: a GRE tunnel interface that was active but had no configuration history or commit record to explain its existence. Sygnia couldn't determine the initial access vector. Following the tunnel led them to a legacy Linux host, which was being used to repeatedly probe administrative ports across adjacent networks, covering SSH, HTTP, SMB, and RDP.
What makes the router-level malware notable is that it was written specifically for the IOS XR control plane rather than being a generic Linux implant dropped onto network hardware. One component hooked outbound log messages and filtered them so only entries containing the string "Health" were passed through, effectively creating a blind spot in router telemetry. A second component modified command execution so that show commands silently appended an exclude filter, hiding the attacker's tunnel from anyone inspecting the device interactively.
Packet captures were pulled from multiple Cisco devices and shipped to external FTP servers, at least one of which appeared to have been set up the same day the uploads happened.
On the TACACS server, Sygnia found a credential-harvesting toolset it's calling TacTap. An injector named acppid loaded a malicious library directly into the running tac_plus authentication process. The library hooked connection-handling functions and passed live session data to a second process via a local Unix socket. Stolen credentials landed in /var/log/.tacplus.acct, obfuscated with a single-byte XOR key of 0xEF. Sygnia says this specific injection technique hasn't been publicly documented before. That said, TACACS credential theft is established territory for this cluster. Mandiant had previously documented UNC3886 deploying a TACACS+ sniffer called LOOKOVER and swapping out the tac_plus daemon for a backdoored replacement.
A new Linux backdoor, which Sygnia named BridgeAgent, was deployed on the tunnel-connected host. It masqueraded as a Zabbix monitoring agent, persisted via a systemd unit running as root, disguised its process as /usr/bin/gnome-shell, and polled attacker infrastructure over TLS on port 443. Believable enough to slip past a casual glance at a process list.
Across the Linux management hosts, Fire Ant built out a layered persistence setup using the open-source Medusa and REPTILE rootkits, custom SSH backdoors, and binaries renamed and timestamped to impersonate SentinelOne and Cybereason security agents. Some of this tooling was planted in 2025 and reused for hands-on operations in 2026. At least one backdoor remained active in memory after its on-disk file had been deleted.
The group also put real effort into covering its tracks: suppressing router logs and SNMP traps, disabling SELinux on Linux hosts, rewriting login history records, and scrubbing privileged command entries from system logs. The forensic picture was deliberately made harder to reconstruct.
Sygnia's recommendation is that routers, TACACS servers, hypervisors, and jump hosts should be treated as forensic assets in their own right, and that log data should always be cross-referenced against memory, disk, network, authentication, and configuration evidence rather than treated as a single reliable source.
For defenders, Sygnia published the following indicators of compromise.
TacTap: injector at /usr/sbin/acppid (SHA1: 36005f5e4398a1c62a2a9271eddfcc1b44b1ad00), injected library at /lib/libseconfd.so (955cd45a2f6f226a2fdf44b329af1c8dde90cb38), credential output at /var/log/.tacplus.acct decoded with XOR key 0xEF.
BridgeAgent: persists via zabbix_agent.service, encrypted config at /opt/.ICEauthority, C2 over TLS port 443.
IOS XR implants: /usr/bin/acpid (be6b27f429324a4af05a310d8ec9635e37c68a94), /pkg/bin/dhcpd_show_issu_status (1682b652a15bde732489f22809b0b7594c228fd3), /pkg/bin/hd (b149fa3a34bd585e7a674a4fd9538437bd06f514), persistence script at /etc/rc.d/init.d/grub-rommon.
VMCI backdoor: /var/tmp/audit (13f0c2a598e3aa63856c032a96b110aed963f0e8), communicating over VMware VMCI sockets.
Packet-triggered backdoor: /var/tmp/ping (5ba1242050b5b447052b210788a5a25593d6987d), activating on TCP ports 443, 541, 8443, and 10443 and UDP source port 40443 to destination port 500, triggered by the string sxcdewqaz!@#.
Full indicator sets and YARA rules are in Sygnia's published report.
The parallels with Salt Typhoon are hard to ignore. A CISA-led advisory from August 2025 attributed similar router and TACACS+ traffic collection to that separate Chinese cluster, which harvested administrator credentials from telecommunications networks using compromised routers. Different group, same playbook. Which probably tells you something about what's considered effective.