Security researchers have uncovered a sophisticated China-nexus cyber-espionage campaign in which attackers compromised Cisco IOS XR routers, TACACS authentication servers and Linux management systems, turning trusted network infrastructure into a platform for surveillance, credential theft and stealthy access.
The activity is being tracked by incident-response firm Sygnia under the name Fire Ant.
Rather than simply compromising ordinary servers or employee endpoints, Fire Ant targeted the infrastructure that organizations rely on to route traffic, authenticate administrators and record security activity.
Once inside, the attackers captured network traffic, harvested administrative credentials, concealed malicious configurations and actively manipulated security telemetry.
In some cases, the systems defenders would normally trust to explain what happened were themselves under attacker control.
That makes the campaign particularly dangerous.
When an attacker controls a router, an authentication server and the logs generated by those systems, traditional incident-response assumptions begin to break down.
Fire Ant Moves From VMware to Network Infrastructure
Fire Ant was first publicly documented by Sygnia in 2025 after researchers investigated highly persistent attacks against VMware ESXi and vCenter environments.
The actor's 2026 activity represents an evolution of the same basic strategy.
Instead of concentrating only on virtualization infrastructure, Fire Ant moved deeper into what Sygnia calls the trusted infrastructure layer.
Targets included:
- Cisco IOS XR routers
- TACACS authentication servers
- Linux management hosts
- jump systems
- virtualization infrastructure
These systems are especially valuable because they often sit between multiple network zones and are trusted by large parts of the environment.
A compromised workstation gives an attacker access to one computer.
A compromised router or authentication server can potentially provide visibility and access across an entire infrastructure.
A Strange GRE Tunnel Exposed the Attack
The investigation began with an unusual configuration anomaly on a Cisco IOS XR router.
Researchers discovered an active Generic Routing Encapsulation, or GRE, tunnel associated with a particular routing context.
The problem was that administrators could find no normal configuration or commit history explaining why the tunnel existed.
In other words, the router's live operational state no longer matched what its configuration records claimed should be running.
That discrepancy became the starting point for the investigation.
Further analysis showed that Fire Ant had deployed custom malware specifically designed to interact with the IOS XR control plane.
This was not simply generic Linux malware installed on a network appliance.
The malicious components interacted directly with router functions involving:
- system logging
- command execution
- routing
- Virtual Routing and Forwarding contexts
- AAA authentication
- Telnet management
Sygnia's researchers concluded that Fire Ant had effectively transformed the router into an attacker-controlled operational platform.
Attackers Manipulated Router Logs
One of the most significant discoveries involved a malicious component masquerading as:
/usr/bin/acpid
The implant incorporated a modified IOS XR syslog library.
Sygnia found that the altered logging process examined outgoing log messages and forwarded them only when specific conditions were met.
The effect was selective suppression of router telemetry.
From a defender's perspective, this creates a dangerous situation.
An administrator might look at the router's logs and conclude that nothing unusual occurred.
But the absence of evidence may simply be because the malware prevented that evidence from being recorded.
Fire Ant also manipulated other telemetry during the wider intrusion, including:
- router logging
- AAA requests
- SNMP traps
- Linux authentication records
- privileged command history
The attackers were therefore targeting not only systems but also the evidence used to investigate those systems.
Even Router Commands Were Manipulated
The actor went further than suppressing logs.
Sygnia recovered another malicious component that altered how administrators viewed information from the router's command-line interface.
The malware modified IOS XR command execution so that additional exclusion filters could be silently added to show commands.
Investigators found activity involving filters designed to hide information connected to the malicious tunnel, including its interface, source, destination and routing context.
That means an administrator could manually inspect the router and still receive an incomplete picture.
This is an important distinction.
Many security teams assume that even if centralized monitoring is compromised, logging into a device directly will reveal its true configuration.
Fire Ant demonstrated that this assumption may fail when the device itself has been modified to lie to its administrator.
The Router Became a Surveillance Platform
After compromising the Cisco infrastructure, Fire Ant also used routers to collect network traffic.
Sygnia observed packet captures being generated on multiple Cisco devices and exported to external FTP servers.
The activity used legitimate administrative workflows and accounts, making it harder to distinguish from normal maintenance.
Packet captures from routers can be extremely valuable to an espionage actor.
Depending on the environment, they may reveal:
- internal network topology
- administrator connections
- authentication flows
- routing relationships
- application communications
- connections between separate security zones
- potential credentials or session information
A compromised endpoint shows an attacker what happens on one machine.
A compromised router may show what happens across a large portion of the network.
Fire Ant therefore gained both reach and visibility.
TACACS Became a Credential Trap
The campaign also targeted TACACS, an authentication protocol commonly used to control administrative access to routers, switches and other network equipment.
Organizations often use TACACS servers as a central authority to determine:
- who can log into network devices
- what commands administrators can execute
- what administrative actions should be recorded
Fire Ant compromised this authentication layer as well.
Sygnia discovered a previously undocumented credential-stealing toolkit it calls TacTap.
The toolkit included a malicious injector called:
/usr/sbin/acppid
and a malicious library:
/lib/libseconfd.so
The injector placed the malicious library directly inside the running tac_plus authentication process.
The library then hooked functions responsible for accepting TACACS sessions and passed active connection handles to another malicious process.
This allowed the attackers to position their code inside the authentication workflow itself.
Administrative Credentials Were Captured
Sygnia recovered a hidden credential file at:
/var/log/.tacplus.acct
The file contained TACACS-related credential material and had been lightly obfuscated using a single-byte XOR operation.
In practical terms, Fire Ant could potentially harvest administrative credentials while legitimate engineers were using them.
This is significantly more serious than stealing one administrator's password from one workstation.
TACACS represents an authentication chokepoint.
Compromise there may expose credentials belonging to multiple administrators across multiple network devices.
It also creates another forensic problem.
If an attacker steals a legitimate administrator's credentials and later uses them, security logs may show that the real administrator acted.
The question is no longer simply:
Which account executed the command?
Defenders also need to ask:
Can we trust the authentication system that recorded it?
Similarities With UNC3886
Fire Ant's activity shows notable technical overlap with UNC3886, a China-nexus espionage group extensively documented by Mandiant.
UNC3886 has historically targeted difficult-to-monitor technologies including:
- VMware hypervisors
- Fortinet devices
- Juniper routers
- network management infrastructure
- TACACS servers
Mandiant previously documented UNC3886 using malware called LOOKOVER to capture TACACS credentials and later replacing the legitimate tac_plus daemon with a backdoored version.
Mandiant has also documented UNC3886 compromising Juniper routers and deploying custom malware specifically designed to operate on network infrastructure that often lacks conventional endpoint-security monitoring.
Sygnia's Fire Ant investigation contains several similarities, including credential collection, use of related rootkit techniques and even reuse of the same XOR value previously observed in UNC3886's TACACS credential theft.
However, Sygnia has not made a definitive attribution linking Fire Ant to UNC3886.
The safest conclusion is that Fire Ant is a China-nexus espionage actor whose techniques overlap significantly with previously documented UNC3886 activity.
Linux Management Systems Were Also Backdoored
The operation extended beyond Cisco routers and TACACS servers.
Sygnia discovered persistent malware across Linux management infrastructure.
One newly documented implant, called BridgeAgent, masqueraded as a Zabbix monitoring agent.
It persisted through a zabbix_agent.service systemd service running with root privileges.
Once active, it disguised its process as:
/usr/bin/gnome-shell
and communicated with attacker-controlled infrastructure over encrypted connections.
The attackers also used:
- Medusa-related rootkit components
- REPTILE-style backdoors
- custom SSH backdoors
- packet-triggered implants
- binaries masquerading as SentinelOne and Cybereason software
Several malicious components were originally deployed in 2025 and remained usable into 2026, demonstrating Fire Ant's focus on long-term persistence.
Malware Disguised as Security Software
In one particularly deceptive technique, Fire Ant renamed malicious software to resemble legitimate endpoint-security components.
The attacker placed malware inside directories associated with security products and modified timestamps so the files appeared consistent with legitimate software.
Some malicious files were then deleted while their processes continued running in memory.
This creates problems for investigations based only on filesystem analysis.
A malicious process may remain active even though its original executable no longer exists on disk.
Sygnia therefore recommends examining multiple evidence sources rather than assuming disk artifacts tell the complete story.
Fire Ant Explored Connected Critical Infrastructure
One of the more concerning aspects of the campaign was what Sygnia calls the “target behind the target.”
The initially compromised environment had trusted connections into other valuable networks.
By controlling routers, authentication servers and Linux management systems, Fire Ant gained a position from which it could explore those connections.
Researchers observed scanning and connection attempts toward high-value environments, including systems associated with critical infrastructure.
The activity involved services such as:
- SSH
- HTTP and HTTPS
- SMB
- RPC-related ports
- RDP
However, an important distinction is necessary.
Sygnia did not report confirmed compromise of those connected critical-infrastructure environments.
The observed activity consisted of reconnaissance, probing and attempts to establish connectivity.
How Did Fire Ant Initially Compromise the Cisco Routers?
That remains unknown.
Sygnia identified extensive post-compromise activity and reverse-engineered the malicious components deployed on the Cisco IOS XR environment.
But investigators were unable to determine the actor's original entry point into the router.
This matters because the incident should not be described as exploitation of a specific Cisco vulnerability unless additional evidence emerges.
There is currently no basis in Sygnia's report for saying that a particular CVE was responsible.
The attacker may have obtained access through:
- stolen credentials
- another compromised management system
- a vulnerability
- an undocumented access path
but stating which one would be speculation.
Organizations should therefore focus not only on patching but also on securing the entire network-management trust chain.
Why Routers Are Attractive Espionage Targets
Routers occupy a unique position inside corporate networks.
They frequently:
- connect different security zones
- carry sensitive traffic
- handle administrator sessions
- maintain network topology information
- communicate with authentication servers
- provide connectivity to external organizations
At the same time, many routers do not support the same EDR agents deployed to Windows and Linux servers.
Threat groups such as UNC3886 have repeatedly focused on infrastructure of this type because it provides privileged access with comparatively limited endpoint visibility.
A network device may therefore become a particularly valuable hiding place for a sophisticated attacker.
When Security Logs Become Untrustworthy
Perhaps the most important lesson from Fire Ant's campaign is not the malware itself.
It is the breakdown of trust in telemetry.
Normally an investigation might use:
- router configuration history
- syslog
- TACACS accounting
- Linux authentication records
- SNMP events
- command histories
to reconstruct an intrusion.
Fire Ant manipulated several of these sources simultaneously.
An incident responder looking at only one log source could therefore reach the wrong conclusion.
A clean router log does not mean nothing happened if the router's logging subsystem was compromised.
A legitimate TACACS login does not necessarily identify the attacker if the authentication server was stealing credentials.
A clean filesystem does not guarantee malware is gone if deleted processes remain active in memory.
Security teams need independent evidence sources that can corroborate one another.
What Organizations Should Do
Organizations operating Cisco routers and centralized network-management infrastructure should treat routers, authentication systems and management hosts as first-class security assets.
✅ Monitor Network Devices Independently
Do not depend entirely on logs generated by the device being monitored.
Where possible, export telemetry to external, protected systems that the network device cannot modify retroactively.
✅ Protect TACACS Infrastructure
TACACS servers should be treated as highly privileged authentication systems.
Administrative access should be tightly limited and activity on the server should be monitored for:
- unexpected libraries
- process injection
- modified
tac_plusbinaries - suspicious credential files
- unfamiliar local sockets
- unusual root-level processes
✅ Compare Configuration With Operational State
Unexpected interfaces, tunnels or routes that cannot be explained by configuration history should be investigated.
Fire Ant's hidden GRE tunnel was discovered precisely because the router's operational state did not match its expected configuration.
✅ Restrict Router Management Access
Management interfaces should only be reachable from dedicated administrative networks.
Internet exposure and broad internal access should be avoided.
✅ Protect Administrator Credentials
Use tightly controlled privileged accounts and minimize credential reuse across network devices.
Where practical, privileged access should be supported by hardened administrative workstations and strong authentication.
✅ Examine Memory During Investigations
Disk-only forensic checks may miss sophisticated implants.
Memory analysis can reveal processes whose executable files have already been deleted or hidden.
✅ Hunt Across the Entire Management Layer
If one router is compromised, the investigation should extend beyond that router.
Organizations should review:
- neighboring routers
- TACACS servers
- jump hosts
- hypervisors
- Linux management systems
- administrative workstations
- connected networks
The compromised router may be only one component of a larger access architecture.
Final Thoughts
Fire Ant's 2026 campaign demonstrates how dangerous a compromise of core network infrastructure can become.
According to Sygnia, the China-nexus actor turned Cisco IOS XR routers into covert operational platforms, captured network traffic, suppressed security logs and manipulated command output. It compromised TACACS authentication infrastructure to harvest administrator credentials and maintained long-lived access through Linux management systems.
The actor then used that privileged position to explore routes toward other high-value networks, including critical infrastructure, although Sygnia has not reported successful compromise of those connected environments.
The initial method used to access the Cisco routers also remains unknown, and the research does not identify a specific Cisco CVE as the entry point.
What is confirmed is arguably more important: once Fire Ant gained control of trusted infrastructure, it could influence both the network and the evidence defenders relied upon to understand that network.
Routers, authentication servers, hypervisors and management hosts cannot be treated as invisible infrastructure. They are high-value security assets, and when attackers compromise the trust layer itself, logs and credentials that normally provide certainty may become part of the deception.
