Fire Ant APT Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

A China-nexus cyber espionage group tracked as Fire Ant has expanded beyond VMware hypervisors to compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts used to authenticate and operate high-value networks. Incident response firm Sygnia, which investigated the intrusion, said the actor weaponized the compromised routers as collection platforms, capturing live network traffic, harvesting credentials, and suppressing the logging and telemetry that defenders rely on to reconstruct attacks. The firm assessed that Fire Ant used its foothold to explore paths to connected critical infrastructure environments, though activity against those targets was limited to scanning and connection attempts rather than confirmed compromise. "When a threat actor controls routers, they do not only gain reach. They gain perspective," Sygnia noted in its report.

The investigation began with an anomaly on a Cisco IOS XR router: a Generic Routing Encapsulation (GRE) tunnel interface operating with no running configuration or commit history to explain its creation. Sygnia did not identify the initial access vector. Tracing the tunnel led investigators to a legacy Linux system that ran repeated connection attempts and port probing against administrative and service ports on connected networks, including SSH, HTTP, SMB, and RDP. The router malware was purpose-built for the IOS XR control plane. One component embedded a modified system library that inspected each outgoing log message for the string "Health" and forwarded it only when present, silently discarding everything else. A second component altered the router's command-execution path to append an "| exclude" filter to show commands, hiding the attacker's tunnel configuration from administrators inspecting the device. Fire Ant also captured packet captures (PCAPs) from multiple Cisco devices, exfiltrating the traffic via the tunnel.

Sygnia said the activity strongly overlaps with public reporting on UNC3886, a China-nexus espionage group known for targeting virtualization platforms and network edge devices, though it stopped short of a conclusive attribution. Mandiant, which first documented UNC3886, has previously stated it found no technical overlap between the group and the separate Chinese operations tracked as Salt Typhoon and Volt Typhoon. The 2026 activity follows Sygnia's July 2025 disclosure of Fire Ant, which detailed the group's exploitation of VMware ESXi and vCenter environments before pivoting into the network and management layers. Organizations should immediately audit router configurations for unapproved GRE tunnels, rotate administrative credentials exposed on TACACS servers, and run a port scanner to identify rogue listeners on management subnets. Any credentials that may have transited the compromised routers should be validated against known compromises using an email breach checker and stress-tested with a password checker before reuse.