A China-linked espionage group tracked as Fire Ant has moved beyond its earlier focus on VMware hypervisors to compromise Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts sitting at the core of high-value enterprise and critical infrastructure networks. Incident response firm Sygnia, which investigated the intrusion, said the attackers turned compromised routers into collection platforms — capturing packet captures, harvesting credentials from authentication servers, and deliberately suppressing the logging and telemetry that defenders use to reconstruct attacks. The activity strongly overlaps with UNC3886, the China-nexus espionage group Mandiant first documented for targeting edge devices and virtualization platforms; Sygnia stopped short of making a definitive attribution.
The investigation began with an anomaly on a Cisco IOS XR router: a GRE tunnel interface was active with no configuration history to explain how it had been created. Sygnia traced the tunnel to a legacy Linux system from which Fire Ant issued repeated port scans and connection attempts against administrative ports across connected networks. The router malware was custom-built for the IOS XR control plane. One component modified an outgoing log filter so that only log messages containing the string “Health” were forwarded — effectively blinding defenders to attack-related events. A second component altered the router’s show command output to silently exclude the attacker’s tunnel configuration, hiding it from administrators viewing the device. On the TACACS server, investigators found a credential-collection toolset Sygnia calls TacTap, which injected a malicious library into the running authentication process to intercept live session credentials. “When a threat actor controls routers, they do not only gain reach — they gain perspective,” Sygnia said.