Listen to this Post
A New Era of Trusted-Infrastructure Attacks
Cybersecurity is entering a dangerous phase in which attackers are no longer satisfied with compromising ordinary endpoints, servers, or applications. The more valuable target is increasingly the infrastructure that quietly controls everything else: routers, authentication servers, management systems, virtualization platforms, and the telemetry designed to expose suspicious activity.
That shift is at the center of a new investigation into Fire Ant, a China-nexus espionage actor that has expanded its operations from VMware environments into Cisco IOS XR routers, TACACS authentication infrastructure, and Linux management hosts. According to Sygnia, the group has turned trusted network infrastructure into an operational platform for persistence, credential theft, traffic collection, covert communications, and evidence suppression.
At almost the same time, another campaign highlighted a different but equally revealing weakness: attackers are pretending to be legitimate AI crawlers from companies such as OpenAI, Anthropic, Google, and Perplexity while scanning websites for exposed credentials, private keys, configuration files, and other secrets.
Together, these incidents reveal a common strategy. Attackers are increasingly hiding inside systems that administrators already trust.
Fire Ant Is Moving Beyond VMware
Fire Ant was first publicly reported in 2025 in connection with persistent attacks against VMware ESXi and vCenter environments. In its latest investigation, Sygnia says the actor has expanded its reach into the infrastructure layer surrounding those environments rather than concentrating exclusively on hypervisors.
The change is strategically important. A compromised workstation may provide access to one user or one segment of an organization. A compromised router, authentication server, or management host can provide something much more valuable: visibility and control over many systems simultaneously.
Sygnia describes this as an attack against trusted infrastructure. Fire Ant’s targets included Cisco IOS XR routers, TACACS servers, and Linux management systems that sit in strategically important positions inside networks.
The Hidden GRE Tunnel That Exposed the Operation
The investigation reportedly began after responders discovered an active Generic Routing Encapsulation (GRE) tunnel on a Cisco IOS XR router.
The problem was simple but alarming: investigators could not explain the tunnel through the router’s legitimate running configuration or commit history.
That immediately raised the possibility that something outside the normal administrative process had modified the device.
The tunnel gave Fire Ant a covert pathway through the network, allowing the compromised infrastructure to communicate with systems that defenders would normally consider separated from one another.
Cisco Routers Became More Than Network Devices
The most concerning aspect of the operation was not simply that a router had been compromised.
Fire Ant reportedly transformed compromised Cisco routers into active collection and operational platforms.
Instead of using the router merely as an entry point, the attackers could use it to observe network traffic, maintain connectivity, manipulate administrative output, and interfere with logging. Sygnia says the routers became strategically positioned infrastructure for collecting information and exploring paths into connected environments.
This is a major evolution in network espionage because routers are rarely treated like traditional endpoints. Security teams frequently concentrate their deepest monitoring on servers, laptops, cloud workloads, and identity systems.
An attacker who understands that imbalance can exploit it.
Custom IOS XR Malware Raises the Stakes
Fire Ant did not rely solely on conventional Linux malware transplanted onto a networking appliance.
Sygnia identified purpose-built tooling designed for the Cisco IOS XR environment. One component reportedly modified logging behavior so that selected messages were suppressed or manipulated, while another interfered with command execution and administrative visibility.
This demonstrates a level of operational preparation that is difficult to dismiss as opportunistic hacking.
The attackers appear to have understood how administrators investigate Cisco devices and then designed malware specifically to interfere with those investigative habits.
Hiding the Evidence Instead of Simply Deleting It
Traditional attackers often try to erase files, delete logs, or remove obvious malware.
Fire
Rather than simply eliminating every trace, the actor manipulated the information defenders were most likely to trust. Sygnia identified suppression or manipulation involving router logs, SNMP telemetry, authentication activity, command histories, and host-level records.
That distinction matters enormously.
If the evidence itself has been altered, a clean-looking security dashboard does not necessarily mean a clean environment.
BridgeAgent Added Another Layer of Persistence
Investigators also discovered a Linux backdoor called BridgeAgent, which reportedly masqueraded as a Zabbix monitoring agent.
The malware was configured as a systemd service and operated with root privileges. Sygnia says it disguised its process and communicated with attacker infrastructure over TLS on port 443, supporting command execution and reverse-shell functionality.
Masquerading as legitimate monitoring software is particularly effective because security teams expect monitoring agents to run continuously and communicate with external infrastructure.
A malicious process that looks like monitoring infrastructure can disappear into the background noise of a busy enterprise network.
Fire Ant Built Multiple Persistence Paths
The operation was not dependent on a single backdoor.
Sygnia found multiple persistence mechanisms across Linux management infrastructure, including Medusa- and REPTILE-related components, custom SSH backdoors, and binaries renamed or timestamped to resemble legitimate security software.
Some components were reportedly planted as early as 2025 and remained useful during activity observed in 2026.
That long lifespan suggests that Fire Ant was not operating like a smash-and-grab intrusion.
It was building an infrastructure of access.
Memory Persistence Makes Investigations Harder
One of the most difficult findings for defenders is that at least one backdoor reportedly remained active in memory even after its corresponding file had been deleted.
That creates a serious forensic problem.
A conventional file scan can report that a suspicious binary is gone while the malicious functionality continues operating inside a running process or memory-resident component.
This is another reason why incident response cannot rely exclusively on disk-based indicators.
The Authentication Layer Was Also a Target
Fire
TACACS systems are especially valuable because they can sit at the center of administrative access to network equipment.
Compromising that layer can potentially expose authentication information and weaken the reliability of administrative audit trails. Sygnia specifically identifies the authentication layer as one of Fire Ant’s strategic targets.
The lesson is uncomfortable: protecting the network is not enough if the system that decides who is allowed to administer the network has been compromised.
The Target Behind the Target
The most important strategic finding may be Fire Ant’s interest in environments connected to the compromised infrastructure.
Sygnia says the actor explored pathways toward high-value environments, including critical infrastructure, although the investigation described scanning and connection attempts rather than confirmed compromise of those downstream targets.
This distinction is critical.
The evidence supports reconnaissance and attempted access, not a blanket conclusion that Fire Ant successfully breached every connected organization.
Nevertheless, the ability to reach those environments through trusted infrastructure represents a significant strategic advantage.
Why Routers Are Attractive to Espionage Groups
Routers occupy an unusual position in enterprise security.
They see enormous amounts of traffic.
They connect different network segments.
They often operate for years.
They are managed by specialized teams.
And they are not always monitored with the same endpoint-security depth applied to Windows and Linux servers.
For a sophisticated espionage actor, that combination makes network infrastructure extremely attractive.
The AI Crawler Impersonation Campaign
While Fire Ant demonstrates how attackers can abuse trusted infrastructure, a separate campaign shows how criminals are abusing trusted identities at the application layer.
GreyNoise reported that attackers were forging AI crawler identities associated with OpenAI, Anthropic, Google, and Perplexity while sending automated requests designed to locate exposed credentials and secrets.
The traffic included forged crawler names such as ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended, and PerplexityBot.
The apparent goal was not legitimate indexing.
It was reconnaissance for secrets.
824 IP Addresses Were Linked to the Activity
GreyNoise identified 824 IP addresses associated with the forged crawler traffic, distributed across 795 separate /24 networks.
That geographic and network distribution makes simple IP blocking much less effective.
More importantly, GreyNoise reported that none of the 824 addresses matched the published IP ranges used by the legitimate crawlers they claimed to represent.
The lesson is straightforward: a user-agent string is not an identity.
Fake Crawlers Were Looking for Real Secrets
The suspicious requests targeted files and paths commonly associated with exposed credentials, including environment files, cloud access keys, private keys, and password stores.
A legitimate AI crawler has no sensible reason to crawl an application’s .env file looking for database passwords.
That behavioral difference is far more useful for defenders than the crawler name itself.
The Missing Robots.txt Request
GreyNoise found another important behavioral clue.
Legitimate crawlers generally interact with robots.txt to understand a site’s crawling rules, while the forged crawler traffic reportedly did not request robots.txt during the observed activity.
Instead, the suspicious traffic went directly toward sensitive paths.
This creates a useful detection principle: when a supposedly legitimate crawler behaves nothing like a crawler, the claimed identity should immediately become questionable.
Why User-Agent Filtering Is No Longer Enough
A User-Agent header is supplied by the client.
That means an attacker can write almost any identity into it.
A malicious scanner can claim to be a search engine, browser, monitoring system, security scanner, or AI crawler without actually being any of those things.
GreyNoise’s findings demonstrate why organizations should combine user-agent information with source IP validation, behavioral analysis, request patterns, and other network signals.
The Common Thread Between Both Campaigns
Fire Ant and the fake AI crawler campaign may appear unrelated at first.
One targets network infrastructure.
The other targets websites.
But their underlying philosophy is remarkably similar.
Both operations exploit trust.
Fire Ant abuses trusted routers, authentication systems, and management hosts.
The crawler campaign abuses trusted names associated with major AI companies.
In both cases, attackers attempt to hide malicious behavior behind something defenders already recognize as legitimate.
Trust Has Become an Attack Surface
Modern security architecture is built around trust relationships.
Routers are trusted to route.
Authentication servers are trusted to authenticate.
Monitoring agents are trusted to monitor.
AI crawlers are trusted to crawl.
When attackers compromise or imitate those trusted identities, conventional security assumptions begin to fail.
That is why the most dangerous attacks may no longer look obviously malicious.
They may look familiar.
Deep Analysis: What This Means for Modern Defenders
Command 1 — Audit Cisco Tunnel Configuration
Administrators investigating suspicious Cisco IOS XR activity should begin by comparing the active tunnel configuration against authorized configuration history and expected network architecture.
show running-config | include ^interface|tunnel|description
show configuration commit list
show interfaces description
The objective is not to blindly remove a tunnel but to identify unexplained interfaces and compare them with documented network changes.
Command 2 — Review Routing Changes
Unexpected routes can provide an attacker with a pathway into networks that were never intended to be reachable from a compromised device.
show route
show route summary
show cef
Unexpected routes should be compared against approved architecture and recent change records.
Command 3 — Examine Active Connections
Network defenders should look for unexpected outbound communication from infrastructure devices.
show tcp brief
show udp
show users
The exact commands and availability depend on IOS XR version and device configuration, so they should be validated against the organization’s operational procedures.
Command 4 — Search Linux Services
On connected Linux management systems, defenders should inspect systemd services for unfamiliar names, unusual execution paths, or services running with excessive privileges.
systemctl list-units --type=service --state=running systemctl list-unit-files --type=service
Particular attention should be paid to services impersonating monitoring, security, or management software.
Command 5 — Inspect Suspicious Processes
A process claiming to be legitimate should be checked against its executable path and parent process.
ps auxww ps -ef
A suspicious process that resembles a legitimate monitoring or desktop component deserves deeper forensic examination rather than immediate deletion.
Command 6 — Look for Deleted Executables
Memory-resident malware can remain active after its disk file disappears.
ls -la /proc//exe 2>/dev/null | grep deleted
This can help identify processes whose executable files have been removed.
Command 7 — Review SSH Persistence
Because custom SSH backdoors were reportedly part of the Fire Ant toolkit, administrators should review authorized keys and SSH-related configuration.
find /home /root -name authorized_keys -type f -print
Unexpected keys should be investigated against account ownership and change records.
Command 8 — Hunt for Fake Crawler Requests
Web servers should search request logs for AI crawler user-agent strings combined with sensitive paths.
grep -Ei 'GPTBot|ClaudeBot|ChatGPT-User|OAI-SearchBot|PerplexityBot|Google-Extended' access.log
The objective is to identify suspicious behavior rather than automatically blocking every legitimate crawler.
Command 9 — Search for Exposed Secrets
Defenders should verify that sensitive files cannot be served from public web directories.
/.env /.git/config /.aws/credentials
These paths should never be publicly accessible from production web applications.
Command 10 — Validate Crawler Identity
Crawler validation should combine the claimed user agent with the publisher’s official IP ranges.
A request claiming to be an AI crawler but originating from an unrelated network should be treated as suspicious.
Command 11 — Check robots.txt Behavior
Security teams can compare claimed crawler traffic with expected crawling behavior.
A crawler that consistently skips robots.txt while requesting credential files is demonstrating behavior inconsistent with legitimate indexing.
Command 12 — Rotate Exposed Credentials
If credentials were publicly accessible through a web path, organizations should treat them as compromised.
Deleting the exposed file is not sufficient.
The associated passwords, API keys, cloud credentials, and tokens should be rotated and their historical use reviewed.
Command 13 — Compare Multiple Evidence Sources
Fire Ant demonstrates why relying on a single log source can be dangerous.
Router logs, SNMP telemetry, authentication records, endpoint telemetry, network captures, memory analysis, and configuration history should be compared against one another.
Contradictions between these sources can themselves become indicators of tampering.
Command 14 — Protect the Management Plane
Management networks should be separated from ordinary user traffic wherever practical.
Administrative interfaces should not be broadly reachable from untrusted segments, and access should be restricted through strong authentication and tightly controlled network paths.
Command 15 — Treat Infrastructure Devices as Endpoints
Routers and switches should be incorporated into incident-response plans.
They need asset inventories, configuration backups, integrity monitoring, administrative logging, vulnerability management, and documented forensic procedures.
Command 16 — Monitor Authentication Chokepoints
TACACS and other centralized authentication systems deserve the same level of attention as identity providers and directory services.
An attacker who compromises an authentication chokepoint can potentially undermine the reliability of everything downstream.
Command 17 — Detect Behavioral Anomalies
Security teams should monitor for unusual combinations such as:
New tunnels
Unexpected outbound connections
Sudden configuration changes
New privileged services
Unusual authentication requests
Missing telemetry
Disabled security controls
Unexpected packet captures
Administrative activity outside normal schedules
No single signal proves compromise, but several together can form a strong detection pattern.
Command 18 — Preserve Evidence Before Cleanup
Deleting suspicious malware immediately can destroy valuable forensic evidence.
When feasible, responders should preserve memory, logs, configurations, network evidence, timestamps, and authentication records before making major changes.
This becomes especially important when an attacker may have altered the logging layer itself.
Command 19 — Verify Security Software Identities
Fire Ant reportedly used filenames and timestamps designed to resemble legitimate security products.
That means defenders should verify not just filenames but hashes, signatures, installation paths, parent processes, service definitions, and expected network behavior.
Command 20 — Move Beyond Identity-Based Trust
The broader lesson is that identity must be continuously verified.
A router should not automatically be trusted simply because it is a router.
A crawler should not be trusted because its User-Agent says GPTBot.
A monitoring process should not be trusted because its filename looks familiar.
Trust must be supported by evidence.
What Undercode Say:
The Real Battlefield Is the Infrastructure Layer
Fire
Routers Are Becoming Strategic Targets
A compromised router can provide visibility that a compromised workstation cannot. It sits directly inside the traffic path and can potentially observe, redirect, or facilitate access between network segments.
Security Teams Must Stop Treating Routers as Untouchable Appliances
Network infrastructure needs to be included in modern endpoint-style security thinking. Configuration integrity, behavioral monitoring, forensic readiness, and anomaly detection should extend into the network layer.
Logging Cannot Be Treated as Absolute Truth
One of Fire
Authentication Servers Are High-Value Targets
Compromising authentication infrastructure can have consequences far beyond one compromised machine. Administrative credentials can become a gateway to routers, servers, management systems, and other high-value assets.
The Fake AI Crawler Campaign Shows the Same Problem From Another Direction
Attackers do not necessarily need to compromise trusted infrastructure when they can simply pretend to be trusted entities.
User-Agent Strings Are Not Security Credentials
A User-Agent is just a declaration made by the client. It should never be treated as proof that a request actually came from OpenAI, Anthropic, Google, Amazon, or Perplexity.
Behavioral Detection Is More Powerful
A supposed crawler that immediately requests .env, private keys, cloud credentials, or password stores is revealing its real purpose through behavior.
The 824-Address Distribution Matters
Because the suspicious crawler activity was spread across 824 addresses in 795 /24 networks, blocking one network or one hosting provider is unlikely to solve the problem.
IP Reputation Alone Is Not Enough
Attackers can distribute scanning infrastructure across large numbers of addresses. Security controls therefore need to combine network identity with behavior and request content.
AI Branding Is Becoming a Security Cloak
As AI crawlers become increasingly familiar to web administrators, their names can become useful camouflage for attackers.
Legitimate Crawlers Should Be Verifiable
Organizations that make access decisions based on crawler identity should validate source addresses against the official ranges published by the relevant provider.
Sensitive Files Should Never Depend on Blocking Bad Crawlers
The strongest defense is architectural.
If .env, private keys, cloud credentials, or .git repositories are never exposed through the web root, a malicious crawler has far less to steal.
Secrets Should Be Removed From Public Reach
Credential protection should not depend on whether a request looks legitimate.
Sensitive material should remain outside publicly accessible paths and should be protected through application and infrastructure controls.
Monitoring Systems Can Become Camouflage
Fire
Security Products Must Be Verified Cryptographically and Behaviorally
A filename is not proof of legitimacy.
A timestamp is not proof of legitimacy.
A process name is not proof of legitimacy.
Attackers Are Targeting the Evidence Layer
The next generation of intrusions will increasingly involve attempts to manipulate not only systems but also the evidence defenders use to understand what happened.
Incident Response Must Assume Partial Visibility
A clean log does not automatically mean a clean system.
A clean disk does not automatically mean a clean memory image.
A clean configuration does not automatically mean the device was never modified.
Independent Telemetry Is Becoming Essential
Network sensors, authentication logs, endpoint telemetry, cloud records, and configuration histories can provide alternative evidence when one telemetry source has been compromised.
Long-Term Persistence Changes the Risk Calculation
Fire Ant reportedly maintained components across multiple years of activity. That means organizations should not assume that removing the most obvious implant immediately ends the intrusion.
Persistence Should Be Investigated as a Network-Wide Problem
If one compromised router is found, defenders should investigate adjacent management hosts, authentication systems, administrative accounts, and connected infrastructure.
The Attack Surface Is No Longer Just the Endpoint
Endpoints remain important, but routers, hypervisors, identity systems, monitoring platforms, and management servers are increasingly attractive because they provide strategic access.
Trusted Relationships Can Become Attack Paths
The more organizations connect systems together, the more valuable those connections become to attackers.
Segmentation Must Be More Than a Diagram
A network can appear segmented on an architecture diagram while still providing practical paths through management systems, authentication services, tunnels, or shared infrastructure.
Hidden Tunnels Deserve Special Attention
Unexpected GRE or other tunneling mechanisms should be investigated because they can create communication paths that bypass normal architectural assumptions.
Critical Infrastructure Is Especially Sensitive
Sygnia’s investigation found exploration toward connected high-value environments, including critical infrastructure, although it did not establish confirmed compromise of those downstream environments.
The Correct Response Is Verification, Not Panic
The Fire Ant findings should not be interpreted as evidence that every Cisco router is compromised or that every AI crawler is malicious.
The important lesson is that defenders need mechanisms to distinguish legitimate behavior from convincing impersonation.
Security Teams Need Cross-Domain Visibility
Network engineers, SOC analysts, identity teams, cloud teams, and incident responders cannot operate in isolation when the attacker is moving between those layers.
AI Is Changing Both Sides of Cybersecurity
The rise of AI introduces new defensive capabilities, but it also creates new opportunities for attackers to automate reconnaissance, impersonate legitimate systems, and scale operations.
The Recent AI Security Incidents Make This More Urgent
Recent reporting has also shown increasingly capable AI systems participating in autonomous cyber activity, reinforcing concerns that automated offensive behavior is becoming a practical security issue rather than a purely theoretical one.
Defense Must Become More Adaptive
Static allowlists and simple identity checks are becoming less reliable against attackers who can imitate trusted identities.
The Future Belongs to Continuous Verification
Organizations should increasingly assume that any identity can be forged, any device can be compromised, and any single telemetry source can be manipulated.
Fire Ant Is a Warning About What Comes Next
The significance of this campaign is not simply that Cisco routers were compromised.
It is that attackers are learning to turn the infrastructure defenders trust most into the infrastructure that helps them remain hidden.
The Bigger Lesson for 2026
The strongest security posture is no longer based on asking, “Do we recognize this system?”
It is based on asking, “Can we continuously prove that this system, process, connection, and identity are behaving as expected?”
Fact Check 1 — Fire
✅ Supported: Sygnia reports that Fire Ant expanded from VMware environments into Cisco IOS XR routers, TACACS authentication infrastructure, and Linux management hosts during its continuing 2026 activity.
Fact Check 2 — Hidden GRE Tunnel
✅ Supported: Investigators discovered an unexplained GRE tunnel on a Cisco IOS XR router that was not accounted for by the expected configuration or commit history.
Fact Check 3 — AI Crawler Impersonation
✅ Supported: GreyNoise identified 824 addresses using forged AI crawler identities and reported requests targeting exposed credentials and secrets rather than normal crawler content.
Fact Check 4 — Confirmed Critical-Infrastructure Compromise
❌ Not established: The available reporting says Fire Ant explored or attempted connections toward high-value environments, including critical infrastructure, but does not establish confirmed compromise of every downstream target.
Fact Check 5 — User-Agent Identity
✅ Supported: GreyNoise’s findings demonstrate that attacker-controlled User-Agent strings can impersonate legitimate AI crawlers and therefore should not be treated as proof of crawler identity.
Prediction
The Next Phase Will Target More Network Infrastructure
(+1) Positive for defenders: The growing availability of detailed threat intelligence about infrastructure-level attacks should push organizations to improve monitoring of routers, authentication systems, management hosts, and other previously under-monitored assets.
Router Security Will Become a Board-Level Issue
(+1) Positive for security maturity: As organizations recognize that routers can become persistence and surveillance platforms, network infrastructure security is likely to receive greater attention from security leadership.
Crawler Verification Will Become Standard
(+1) Positive: Web platforms are likely to move away from trusting User-Agent strings and toward verification based on published IP ranges, behavioral fingerprints, rate patterns, and other signals.
Attackers Will Continue Abusing Familiar Names
(-1) Negative: The fake AI crawler campaign is unlikely to be the last example of attackers using trusted brands as camouflage. Security teams should expect impersonation of AI agents, monitoring services, search engines, scanners, and cloud providers to increase.
Infrastructure Attacks Will Become More Stealthy
(-1) Negative: As attackers become better at manipulating logs and administrative output, incident response will become increasingly dependent on independent telemetry and memory-level investigation.
AI Will Accelerate Reconnaissance
(-1) Negative: AI-assisted automation can make reconnaissance faster and more scalable, allowing attackers to search large numbers of systems for small configuration mistakes that would otherwise remain undiscovered.
The Main Security Shift
(+1) Positive if organizations adapt: The most successful defenders will increasingly operate under a zero-trust assumption in which devices, users, processes, crawlers, and infrastructure identities must continuously prove what they are doing rather than being trusted simply because they appear familiar.
Final Verdict: The Infrastructure We Trust Most May Become the Infrastructure Attackers Want Most
A Dangerous Evolution
Fire Ant’s latest activity illustrates a profound change in cyber espionage. The objective is no longer merely to break into a server and steal information. Sophisticated attackers increasingly want to control the systems that connect, authenticate, monitor, and manage everything around that server.
Trust Is the New Battlefield
The fake AI crawler campaign demonstrates the same principle from another angle. Attackers can exploit trust without even compromising the trusted entity itself.
They can simply imitate it.
The Defensive Priority
Organizations should therefore treat network infrastructure, authentication systems, management hosts, and publicly exposed web applications as interconnected parts of one security environment.
The question is no longer whether a device looks legitimate.
The question is whether its behavior can be independently verified.
The Warning for 2026
Fire Ant’s evolution and the rise of AI-crawler impersonation point toward the same uncomfortable future: attackers are learning to hide in plain sight by becoming indistinguishable from the systems, identities, and services defenders already trust.
The organizations that adapt fastest will be those that stop treating trust as a permanent status and start treating it as something that must be continuously earned.
▶️ Related Video (68% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: x.com
Extra Source Hub (Possible Sources for article):
https://www.facebook.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
