China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
Summary: Sygnia reported that a China-nexus actor it tracks as Fire Ant moved from VMware hypervisors into Cisco IOS XR routers, TACACS servers, and Linux management hosts, using the routers to capture traffic, harvest credentials, and suppress logging and telemetry. The investigation began with an unexplained GRE tunnel interface on a Cisco IOS XR router, and Sygnia found purpose-built router malware that forwarded only log messages containing the string Health and appended an exclude filter to hide the tunnel from administrators, along with a TACACS credential toolset it calls TacTap and a Linux backdoor it calls BridgeAgent.
What's compelling: Fire Ant rewrote login-history records, disabled SELinux, and deleted privileged-command log entries, so the evidence a security leader would use to scope the intrusion may already be gone. Sygnia's finding that a backdoor kept running in memory after its file was deleted means disk-based checks alone will miss it.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026