Listen to this Post
Introduction: The Most Dangerous Place to Hide Is Inside the Network Itself
Modern cyber espionage is no longer limited to stealing files from compromised computers. The most sophisticated attackers increasingly want something far more valuable: control over the infrastructure that connects everything together.
A newly documented campaign attributed to the China-nexus threat actor tracked as Fire Ant demonstrates exactly how dangerous that strategy can become. After previously targeting VMware ESXi and vCenter environments, the group has expanded deeper into enterprise infrastructure, compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management systems.
The result is a frightening level of visibility.
An attacker who controls an ordinary endpoint may see one machine. An attacker who controls a router can potentially observe the conversations between thousands of machines. An attacker inside an authentication server may capture the credentials that administrators use to control the entire environment.
According to incident response firm Sygnia, Fire Ant used this privileged access to collect network traffic, steal credentials, establish persistent backdoors, explore connected high-value environments, and suppress the very logs defenders would normally use to investigate the intrusion.
The campaign represents a broader shift in advanced cyber espionage. Instead of simply attacking the computers inside a network, sophisticated threat actors are increasingly targeting the systems responsible for routing, authenticating, virtualizing, monitoring, and managing the network itself.
And once those systems are compromised, the attacker is no longer simply inside the network.
They may be watching the network from its most trusted positions.
Summary: Fire Ant Moves Beyond VMware Into the Core of Enterprise Infrastructure
Fire Ant, a China-nexus cyber espionage actor first publicly detailed by Sygnia in July 2025, has expanded its operations beyond VMware hypervisors and management platforms.
The
Sygnia assessed that the attackers transformed compromised routers into intelligence collection platforms capable of capturing network traffic and supporting reconnaissance against connected environments.
The investigation began when defenders discovered something unusual on a Cisco IOS XR router: a Generic Routing Encapsulation, or GRE, tunnel existed without a normal running configuration or commit history explaining how it had been created.
That anomaly became the starting point for uncovering a much larger intrusion.
Tracing the mysterious tunnel led investigators to a legacy Linux system connected to the compromised infrastructure. From that host, the attackers performed repeated connection attempts and port scanning against administrative and service interfaces, including SSH, HTTP, SMB, and RDP.
Sygnia said the activity appeared focused on identifying possible routes toward high-value environments, including critical infrastructure.
However, the investigation found scanning and connection attempts rather than evidence of confirmed compromise of those critical environments.
The attackers also deployed specialized malware directly against Cisco IOS XR infrastructure.
One component manipulated logging behavior by allowing only messages containing a specific string, Health, to be forwarded. Another altered the command execution path to hide malicious tunnel configurations from administrators inspecting the router.
Fire Ant then used compromised network devices to capture packet data from multiple Cisco systems.
Those packet captures were uploaded to external FTP infrastructure, creating an additional channel through which the attackers could collect intelligence and potentially harvest credentials or other sensitive information traveling through the network.
The campaign also included a sophisticated credential theft operation against a TACACS server.
Sygnia discovered a toolset it calls TacTap, which injected a malicious library into the active tac_plus authentication process. The malware intercepted connection-related functions and transferred active session information to another process.
Captured credentials were written to a hidden file and lightly obfuscated.
Sygnia described the library injection technique as a notable evolution in TACACS-focused credential collection.
A second malware family recovered during the investigation was named BridgeAgent.
The Linux backdoor disguised itself as a Zabbix monitoring component, persisted through a systemd service running with root privileges, and masqueraded as the legitimate-looking process /usr/bin/gnome-shell.
The malware communicated with attacker infrastructure over encrypted TLS connections on port 443 and could receive commands and reverse-shell instructions.
Across Linux management hosts, Fire Ant also established a durable ecosystem of persistence and stealth.
Investigators identified open-source rootkits, custom SSH backdoors, renamed binaries impersonating endpoint security products, disabled security controls, manipulated login records, and deleted or altered evidence.
Some malicious components were reportedly planted during 2025 and remained useful for hands-on activity in 2026.
In at least one case, a backdoor continued running in memory even after its corresponding file had been removed from disk.
The campaign strongly overlaps with previously reported activity associated with UNC3886, a China-nexus espionage cluster known for targeting virtualization platforms and network edge devices.
However, Sygnia stopped short of making a conclusive attribution.
The case also highlights similarities with separate activity attributed to Salt Typhoon, particularly the use of compromised routers for packet collection and administrator credential harvesting.
The most important lesson from the investigation is simple.
Routers, authentication servers, hypervisors, jump hosts, and management systems are no longer merely supporting infrastructure.
They are now some of the most strategically valuable targets inside modern networks.
The Router Investigation Began With a Tunnel That Should Not Have Existed
The discovery started with a seemingly small anomaly.
Investigators found a GRE tunnel interface operating on a Cisco IOS XR router without the expected configuration history explaining its existence.
In a normal environment, infrastructure changes leave traces.
Administrators create interfaces.
Configuration management systems record changes.
Logs capture activity.
Commit histories provide context.
But the tunnel discovered by Sygnia lacked the normal evidence expected from a legitimate administrative change.
That immediately raised a critical question: who created the tunnel, and how was it being hidden?
The investigation eventually linked the tunnel to a legacy Linux management host.
From there, Fire Ant conducted reconnaissance against administrative and service ports across connected environments.
This is a critical stage in advanced intrusion operations.
Attackers often do not immediately move toward their ultimate objective.
Instead, they map the environment.
They identify administrative interfaces.
They test connectivity.
They determine which systems are reachable.
They search for credentials, management servers, virtualization platforms, backup systems, and other infrastructure capable of providing deeper access.
A compromised router gives an attacker something particularly valuable during this stage: perspective.
It provides visibility into traffic paths that may be inaccessible from a conventional endpoint.
As Sygnia emphasized, controlling routers does not simply give an attacker reach.
It gives them the ability to observe the network from inside its communication infrastructure.
Fire Ant Used Cisco IOS XR Malware Designed for the Network Control Plane
The malware recovered from the Cisco IOS XR environment was not simply generic Linux malware copied onto a networking appliance.
Sygnia found components specifically designed to interfere with the IOS XR control plane.
That distinction matters.
Highly specialized malware suggests the attackers understood the target environment and developed tooling designed to operate within its architecture.
One malicious component embedded a modified system library that inspected outgoing log messages.
The malware checked whether a message contained the string Health.
Only messages matching that condition were forwarded.
This created a selective logging environment where normal-looking operational telemetry could continue while other potentially revealing activity disappeared from the attacker’s preferred evidence trail.
Another component modified the
The malicious logic appended an | exclude filter to certain show commands, preventing administrators from seeing the attacker’s tunnel configuration during inspection.
This is particularly dangerous because the attacker was not merely hiding files.
They were manipulating the
A defender could log into the router, run diagnostic commands, and receive output that appeared legitimate while important malicious configuration remained invisible.
That is a much deeper form of deception than simply deleting a log file.
It turns the compromised device itself into an unreliable witness.
Packet Captures Turned Network Devices Into Intelligence Collection Platforms
Fire Ant also used compromised Cisco infrastructure to collect packet capture data.
Packet captures, commonly called PCAPs, can be extraordinarily valuable to espionage operators.
Depending on what traffic is visible and whether encryption is properly implemented, captured packets may reveal credentials, internal service communication, authentication activity, administrative sessions, infrastructure architecture, and metadata about valuable systems.
Even when sensitive traffic is encrypted, packet metadata can still provide attackers with intelligence about network relationships and operational patterns.
Sygnia found that captured data was uploaded to external FTP servers.
One of those servers appeared to have been installed on the same day the uploads occurred.
The timing suggests an infrastructure layer prepared specifically to receive collected information.
This demonstrates an important evolution in cyber espionage.
The attackers were not necessarily trying to immediately destroy systems or deploy ransomware.
Instead, they were building quiet collection infrastructure.
Their objective appeared to involve intelligence gathering, credential acquisition, reconnaissance, and long-term access.
This type of operation can remain dangerous precisely because it does not always create the obvious disruption associated with destructive attacks.
A network can continue functioning normally while an adversary quietly observes it.
TacTap Targeted the Authentication Layer Where Administrator Credentials Live
One of the most significant discoveries involved the compromise of a TACACS server.
TACACS+ infrastructure plays a critical role in many enterprise and telecommunications environments by handling centralized authentication and authorization for administrative access to network devices.
Compromising such a system can give an attacker access to something far more valuable than an individual user password.
It may expose the credentials used by privileged administrators.
Fire
The injected library intercepted functions responsible for accepting new connections.
Live session information was then transferred to a second process through a local Unix socket.
Captured credentials were written to:
/var/log/.tacplus.acct
The data was lightly obfuscated using a single-byte XOR key of 0xEF.
The technical significance of the operation is not merely that credentials were stolen.
Credential theft from authentication infrastructure is established espionage tradecraft.
The important development is the method used to perform the interception.
Sygnia said the specific tac_plus library injection technique had not previously been publicly described.
That makes TacTap an important example of how threat actors continue refining credential collection techniques around highly privileged infrastructure.
BridgeAgent Masqueraded as Monitoring Software to Maintain Long-Term Access
Sygnia also discovered a Linux backdoor named BridgeAgent.
The malware was deployed on a host connected to the attacker’s tunnel infrastructure.
It disguised itself as a Zabbix monitoring agent.
That disguise was strategically chosen.
Monitoring software is common in enterprise environments.
Administrators expect monitoring processes to communicate with infrastructure.
They expect services to run continuously.
They expect those services to operate with elevated privileges.
That makes monitoring software an attractive identity for malware attempting to blend into a production environment.
BridgeAgent reportedly persisted using a zabbix_agent.service systemd unit running as root.
It disguised its process as:
/usr/bin/gnome-shell
The implant also maintained encrypted communications with attacker infrastructure using TLS over port 443.
Port 443 is frequently associated with legitimate encrypted web traffic, making it a common channel for malicious command-and-control activity attempting to blend into normal network communications.
The backdoor could receive commands and instructions related to reverse-shell functionality.
Together, these features gave Fire Ant a durable mechanism for returning to the compromised environment.
Rootkits and Security Tool Impersonation Helped Fire Ant Build a Durable Access Layer
The investigation revealed a broader ecosystem of persistence mechanisms across Linux management hosts.
Fire Ant reportedly used tools including Medusa and REPTILE rootkits, custom SSH backdoors, and binaries designed to impersonate endpoint security software.
Some malicious files were renamed and timestamped to resemble products associated with SentinelOne and Cybereason.
This is an important example of operational camouflage.
Security products are normally trusted.
Their names are familiar.
Their processes may be expected to run continuously.
A malicious binary using a believable security-related name may receive less scrutiny during a quick investigation.
The attackers also demonstrated persistence over time.
Several components were planted during 2025 and remained useful during activity observed in 2026.
This indicates that the intrusion was not necessarily a short-term operation.
The attackers appeared willing to invest in long-term access.
That patience is one of the defining characteristics of advanced espionage campaigns.
A threat actor does not always need to move quickly.
Sometimes remaining hidden for months is more valuable than stealing everything in a single day.
Fire Ant Did Not Just Attack the Network, It Attacked the Evidence
One of the most concerning aspects of the investigation was the deliberate effort to undermine forensic visibility.
Fire Ant suppressed router logs.
The group interfered with SNMP traps.
It manipulated authentication-related evidence.
On Linux systems, investigators found efforts to disable SELinux and rewrite login history.
The attackers also removed records associated with privileged commands.
This means defenders faced a difficult problem.
The systems they normally trusted to explain what happened had themselves been compromised.
This is a critical lesson for incident response.
Logs are evidence, but logs are not absolute truth.
If an attacker controls the operating system, network device, authentication infrastructure, or logging pipeline, they may also be able to manipulate what investigators see.
Sygnia therefore recommended treating routers, TACACS servers, hypervisors, and jump hosts as first-class forensic assets.
Investigators should compare multiple evidence sources.
Memory should be compared with disk artifacts.
Logs should be compared with network evidence.
Authentication records should be compared with configuration history.
Telemetry should be validated against independent sources whenever possible.
The more privileged the compromised system is, the less defenders should rely on a single source of truth.
The UNC3886 Connection Remains Strong but Not Conclusive
Sygnia said the Fire Ant activity strongly overlaps with public reporting on UNC3886, a China-nexus espionage cluster known for targeting virtualization environments and network edge devices.
However, the company did not make a definitive attribution.
That distinction is important.
Cyber threat attribution is difficult.
Different groups can reuse similar infrastructure, techniques, tools, and operational concepts.
Attribution requires careful analysis of technical evidence, infrastructure patterns, malware development, operational behavior, and historical targeting.
Mandiant, which previously documented UNC3886, has also distinguished the cluster from other Chinese operations tracked as Salt Typhoon and Volt Typhoon.
This means the broader China-nexus espionage ecosystem should not be treated as one single organization.
Different clusters can have different objectives, targeting priorities, toolchains, and operational methods.
At the same time, the overlap in tradecraft demonstrates a larger strategic pattern.
Network infrastructure, virtualization systems, authentication services, and edge devices have become increasingly attractive espionage targets.
The Campaign Also Echoes Salt
The Fire Ant activity parallels aspects of a separate CISA-led advisory concerning Salt Typhoon activity.
That operation also involved collecting traffic from compromised routers to obtain administrator credentials across telecommunications networks.
The similarity does not automatically prove the same operators were responsible.
However, it demonstrates the strategic value that sophisticated espionage groups place on network infrastructure.
Traditional endpoint compromise gives attackers access to individual systems.
Router compromise can provide a broader intelligence position.
Authentication server compromise can expose privileged credentials.
Virtualization platform compromise can provide access to multiple workloads.
Jump host compromise can provide pathways into administrative environments.
These systems are force multipliers.
That is why modern network defense can no longer focus exclusively on employee laptops and Windows servers.
The infrastructure that connects and controls those systems may be even more strategically important.
Why Routers Have Become Prime Targets for Advanced Cyber Espionage
Routers sit at critical points in the movement of information.
They determine where traffic travels.
They connect internal environments.
They support remote sites.
They often interact with administrative and operational networks.
In some environments, they can observe communication patterns that no individual workstation could see.
For an espionage actor, this is extremely valuable.
A router may reveal which systems communicate with each other.
It may expose administrative traffic.
It may help identify critical services.
It may provide intelligence for lateral movement.
And when packet collection becomes possible, the device can become a surveillance platform.
The most dangerous part is that routers are often treated differently from conventional servers.
Organizations may have mature endpoint detection and response coverage on laptops and servers while network appliances receive less continuous monitoring.
Some organizations collect limited telemetry from routers.
Others retain logs for short periods.
Some lack strong configuration integrity monitoring.
Attackers understand these weaknesses.
That makes infrastructure devices attractive places to hide.
Why Authentication Servers Deserve the Same Protection as Domain Controllers
TACACS servers should be treated as crown-jewel infrastructure.
They often handle privileged access to network devices.
A compromised authentication server can provide attackers with visibility into administrative activity and potentially access to credentials used across multiple systems.
The Fire Ant investigation demonstrates how dangerous that position can become.
Defenders should monitor authentication infrastructure for unexpected processes, modified shared libraries, unauthorized service changes, hidden files, and unusual local socket activity.
Administrators should also investigate unexplained changes to daemon behavior.
Library injection is particularly dangerous because the legitimate service may continue functioning normally while malicious code operates inside the trusted process.
This is one reason process integrity monitoring matters.
A service that appears healthy may still be compromised internally.
Deep Analysis: How Defenders Can Hunt for Infrastructure-Level Compromise
Command 1: Investigate Unexpected Systemd Services
On Linux systems, defenders can review suspicious persistence mechanisms:
systemctl list-unit-files --type=service systemctl status zabbix_agent.service systemctl cat zabbix_agent.service
Unexpected services running with root privileges should be investigated immediately.
Command 2: Search for Suspicious Processes Masquerading as Legitimate Software
Check whether processes claiming to be legitimate applications are actually executing from expected locations:
ps auxww | grep -E "gnome-shell|zabbix|sentinel|cybereason" readlink -f /proc/<PID>/exe ls -l /proc/<PID>/exe
A suspicious process name should never be trusted without validating the actual executable.
Command 3: Inspect Deleted Executables Still Running in Memory
Linux can continue running a process after its original executable has been deleted.
Investigators can search for this condition:
ls -l /proc//exe 2>/dev/null | grep deleted
This is especially valuable when investigating malware designed to remove itself from disk while maintaining active execution.
Command 4: Review Suspicious Network Connections
Identify unusual outbound connections over TLS:
ss -plant lsof -i -P -n
Pay particular attention to persistent encrypted connections from management systems to unknown external infrastructure.
Port 443 alone does not make traffic legitimate.
Command 5: Hunt for Hidden Authentication Artifacts
Search for unexpected hidden files around authentication services:
find /var/log -type f -name "." -ls find /usr -type f -perm -4000 -o -perm -2000 2>/dev/null
Files such as unexpected hidden credential stores should be treated as high-priority forensic artifacts.
Command 6: Validate TACACS Process Libraries
Investigators can inspect loaded libraries for suspicious processes:
cat /proc/$(pgrep tac_plus)/maps lsof -p $(pgrep tac_plus)
Unexpected libraries loaded into an authentication daemon may indicate injection or tampering.
Command 7: Review Router Configuration Integrity
Network administrators should compare current configurations with trusted backups and configuration management records.
Conceptually, defenders should investigate:
Unexpected GRE tunnels
Interfaces without documented change history
Modified show command behavior
Missing telemetry
Unexpected packet capture activity
Unexplained outbound transfers
A configuration that appears normal should also be validated against external configuration history whenever possible.
Command 8: Check for Rootkit Indicators
Defenders investigating Linux management hosts can review kernel modules and hidden network activity:
lsmod
find /lib/modules/$(uname -r) -type f ss -lntup
Unexpected modules or discrepancies between different monitoring tools should trigger deeper investigation.
Command 9: Verify SELinux Status
Because attackers may disable security controls to simplify persistence:
getenforce
sestatus
Unexpected changes in enforcement status should be compared against administrative records.
Command 10: Preserve Evidence Before Cleaning the System
During an active incident, defenders should avoid immediately deleting suspicious files.
Instead, preserve evidence:
sha256sum suspicious_file stat suspicious_file cp --preserve=all suspicious_file /forensic/evidence/
The goal is not simply to remove malware.
The goal is to understand how the attacker entered, persisted, moved, collected data, and hid their activity.
What Undercode Say: The Real Battlefield Is Moving Into Infrastructure
Fire
The attackers did not focus only on employee computers.
They targeted the systems that control the environment itself.
That is the central danger.
A compromised laptop is serious.
A compromised router can become a surveillance platform.
A compromised TACACS server can become a credential collection engine.
A compromised hypervisor can expose entire virtual environments.
A compromised jump host can become a gateway to administrative infrastructure.
The attack surface is becoming more strategic.
Advanced threat actors increasingly understand that infrastructure systems provide disproportionate value.
Instead of compromising one server after another, they can compromise the management layers connecting them.
That approach reduces noise.
It increases visibility.
And it can dramatically improve the
The most alarming part of the Fire Ant investigation is not one specific malware sample.
It is the combination of capabilities.
Network visibility.
Credential theft.
Stealth.
Persistence.
Rootkit deployment.
Log manipulation.
Configuration hiding.
Packet collection.
Long-term access.
These are not isolated techniques.
Together, they form an espionage architecture.
The attacker builds access at several layers simultaneously.
If one foothold disappears, another may remain.
If a file is deleted, a process may still survive in memory.
If logs are reviewed, they may already have been manipulated.
If administrators inspect the router, malicious configuration may be filtered from the output.
That means traditional incident response assumptions can fail.
Organizations often ask, “What logs do we have?”
The better question is, “Which systems created those logs, and can we still trust them?”
This campaign demonstrates why independent telemetry matters.
Network evidence should be compared with endpoint evidence.
Authentication records should be compared with identity systems.
Configuration changes should be compared with trusted backups.
Memory analysis should complement disk analysis.
A sophisticated attacker may be able to manipulate one evidence source.
Manipulating every independent source is much harder.
The campaign also exposes an uncomfortable reality about legacy infrastructure.
The investigation traced important activity to a legacy Linux system.
Old management hosts often remain in networks for years because they support specialized applications or infrastructure.
These systems can quietly become permanent weaknesses.
Organizations should identify legacy systems connected to routers, authentication services, virtualization platforms, and critical management networks.
Those systems deserve aggressive review.
The future of cyber defense will require treating infrastructure devices as endpoints.
Routers need behavioral monitoring.
Authentication servers need integrity monitoring.
Hypervisors need forensic visibility.
Management hosts need strong endpoint protection.
Configuration changes need independent validation.
The distinction between “network device” and “computer” is becoming less meaningful from a security perspective.
If a device runs code, communicates with other systems, stores credentials, or controls traffic, it is a potential target.
Fire
The absence of obvious alerts does not mean the absence of attackers.
Sometimes the quietest intrusion is the most dangerous.
The attackers were not interested in announcing themselves.
They were interested in remaining useful.
And for espionage actors, usefulness often means visibility.
The more of the network they can observe, the more strategically valuable their compromise becomes.
Defenders should therefore stop thinking only about where attackers can enter.
They must also think about where attackers would want to watch.
That question may lead directly to the router.
The authentication server.
The hypervisor.
The jump host.
And the management system nobody has investigated in years.
✅ Sygnia documented Fire Ant activity involving Cisco IOS XR routers, TACACS infrastructure, and Linux management hosts, with the investigation uncovering packet collection, credential theft, persistence, and anti-forensic behavior.
✅ The activity was assessed to strongly overlap with public reporting on UNC3886, but Sygnia did not make a conclusive attribution, meaning the connection should not be presented as definitively proven.
❌ The investigation did not confirm that Fire Ant successfully compromised the critical infrastructure environments it explored. The reported activity was limited to scanning and connection attempts against those connected high-value networks.
Prediction
(+1) Infrastructure-Level Threat Hunting Will Become a Major Defensive Priority
Enterprise security teams will increasingly deploy stronger monitoring and forensic collection across routers, switches, authentication servers, hypervisors, and jump hosts.
Organizations will move toward independent configuration validation because attackers are increasingly capable of manipulating local logs and administrative command output.
TACACS, RADIUS, and other privileged authentication systems will receive more attention as attackers recognize the enormous value of centralized administrator credentials.
Network appliance vendors will face growing pressure to improve runtime integrity monitoring, memory visibility, secure logging, and forensic capabilities.
The most mature security programs will begin treating network infrastructure as a critical endpoint category rather than as a separate and lightly monitored operational layer.
Organizations that continue focusing primarily on employee endpoints while neglecting management infrastructure may face longer attacker dwell times and far greater forensic uncertainty after a breach.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.linkedin.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
