A China-nexus espionage group tracked as Fire Ant has moved past VMware into the network layer. Incident response firm Sygnia says the actor compromised Cisco IOS XR routers, TACACS servers, and Linux management hosts on high-value networks.
The firm found the group turning routers into collection platforms that capture traffic, harvest credentials, and suppress the logging and telemetry defenders need to reconstruct an attack. The activity strongly overlaps public reporting on UNC3886, though Sygnia stopped short of conclusive attribution.
Controlling the routers gave the group a view over traffic flowing along trusted paths, granting reach into connected systems and perspective across them, Sygnia said.
The investigation started with a Cisco IOS XR router running a GRE tunnel interface with no configuration history to explain it. That led to a legacy Linux host, then to routers used for packet captures uploaded to external FTP servers, and to a TACACS server carrying a credential collector Sygnia calls TacTap. An injector loaded a malicious library into the running tac_plus authentication process, hooked connection handling, and passed live session handles to a second process over a Unix socket. Credentials landed in a log file obfuscated with a single-byte XOR key.
Sygnia said the specific tac_plus library-injection technique has not been publicly described before. It also recovered a second new tool, a Linux backdoor named BridgeAgent that masqueraded as a Zabbix monitoring agent and polled attacker infrastructure over TLS.
Across the management hosts, Fire Ant layered open-source Medusa and REPTILE rootkits, custom SSH backdoors, and binaries disguised as endpoint security agents, while rewriting login history and disabling SELinux to hide its tracks.
For incident responders, the firm’s advice is blunt: network gear deserves the same forensic care as endpoints. Cross-check router logs against memory, disk, and authentication evidence instead of leaning on one telemetry stream.
