Listen to this Post
Introduction: When the Router Becomes the Attacker’s Eyes
Network routers are supposed to be among the most trusted devices inside an organization. They sit quietly in the background, forwarding traffic, connecting environments, enforcing routes, and keeping business operations moving. But that same privileged position can make a compromised router one of the most dangerous footholds an attacker can obtain.
A newly uncovered campaign attributed to the China-linked threat actor known as Fire Ant demonstrates exactly how serious that risk can become. Instead of treating routers simply as gateways to other machines, the attackers turned compromised Cisco IOS XR infrastructure into surveillance platforms, hiding their presence, suppressing security logs, capturing network traffic, stealing credentials, and searching for pathways into valuable environments.
The campaign is particularly concerning because the attackers did not rely on noisy or obviously malicious activity. They manipulated trusted infrastructure, concealed evidence inside the router, and used seemingly legitimate components and services to maintain persistence.
This is the kind of intrusion that can remain invisible for far longer than a conventional malware infection.
The Core Attack: Compromising the Network’s Trusted Layer
Fire Ant’s activity reveals an important evolution in network-focused cyberattacks: the router itself can become both the observation point and the launchpad.
Investigators discovered an unexplained GRE tunnel interface on a Cisco IOS XR router. The tunnel was operational, yet investigators could not find a corresponding configuration or commit history explaining its creation.
That discrepancy was a major warning sign.
Routers normally maintain extensive configuration and operational information. When an active interface exists without a corresponding administrative trail, defenders should immediately consider the possibility that the device’s running state has been manipulated outside the normal management process.
In this case, the missing configuration history suggested that Fire Ant had altered the router while attempting to avoid leaving conventional administrative evidence behind.
Cisco Routers Turned Into Spy Platforms
The attackers went considerably further than simply establishing access.
Fire Ant deployed multiple malicious components specifically designed for the Cisco IOS XR environment. One implant was placed within a startup-related path and disguised to look like a legitimate service.
The malware could then launch another component during selected hours.
That timing mechanism is particularly interesting from a defensive perspective. Malware that operates continuously has a much greater chance of being discovered during routine monitoring. Malware that activates only during carefully selected periods can blend into normal operational noise and reduce the amount of suspicious activity visible to administrators.
The objective appears to have been persistence without constant visibility.
Manipulating the Router’s Logs
One of the most dangerous aspects of the campaign was the manipulation of logging.
Attackers modified the
This creates a dangerous blind spot.
A security operations center may believe it is receiving comprehensive telemetry from a router when, in reality, the compromised device is deciding which events defenders are allowed to see.
That distinction is critical.
Hiding Commands and Configuration Details
Fire Ant also used another component to manipulate command execution and filter router output.
This capability could potentially prevent administrators from seeing important information such as tunnel configurations, routing details, or other evidence associated with the compromise.
That creates an especially difficult forensic environment.
A defender sitting directly in front of the affected router could execute commands and receive apparently normal output while the malicious implant selectively removes information that could reveal its existence.
The problem is no longer simply “the attacker has access.”
The problem becomes “the device cannot necessarily be trusted to tell administrators the truth.”
Packet Capture: Turning the Router Into a Surveillance Sensor
The attackers also exploited the
Investigators observed the creation of PCAP files from multiple router interfaces, followed by the transfer of those captures to external FTP infrastructure.
Packet captures can be extremely valuable to an attacker.
Depending on the traffic being captured and the security controls surrounding it, PCAP data may expose internal network architecture, management connections, authentication activity, application behavior, hostnames, addresses, protocols, and communication patterns between different environments.
Even when credentials and sensitive payloads are encrypted, metadata can still reveal an enormous amount about an organization.
The attackers therefore did not necessarily need to compromise every machine individually.
They could watch the network from a trusted position.
The Router as a Strategic Observation Point
This is what makes the campaign more significant than a conventional router compromise.
A compromised workstation provides access to one environment.
A compromised router can provide visibility across an entire network segment or multiple interconnected environments.
From that position, an attacker can learn which systems communicate, which services are exposed, where management infrastructure resides, and which routes potentially lead toward more valuable targets.
The router becomes an intelligence-gathering platform.
That intelligence can then guide subsequent intrusion attempts.
The Hidden GRE Tunnel
The unexplained GRE tunnel was one of the clearest indicators that the compromised router had been transformed into something much more than a traffic-forwarding device.
GRE tunnels are legitimate networking technology and are widely used for connecting networks and systems.
That makes them attractive to attackers.
A malicious tunnel can potentially provide a covert communication pathway while appearing less suspicious than an entirely unfamiliar networking mechanism.
In this campaign, the tunnel connected the compromised environment to a legacy Linux system.
That Linux machine then became another operational platform for Fire Ant.
From Router Compromise to Linux Reconnaissance
Once the attackers established access through the router and tunnel, they used the connected Linux host to repeatedly attempt connections and scan systems associated with high-value and critical infrastructure environments.
The scans reportedly targeted services such as:
SSH
HTTP
HTTPS
SMB
RPC
RDP
This is a familiar reconnaissance pattern, but its location within the attack chain makes it more concerning.
Fire Ant was not blindly scanning the internet.
The attackers had already gained a privileged position inside trusted infrastructure and were using that position to understand what existed beyond it.
That is a classic example of how an intrusion can evolve from initial access → persistence → surveillance → reconnaissance → potential lateral movement.
The Linux Backdoor Disguised as Monitoring Software
Researchers also identified a backdoor named zabbixagent.
The name is significant because it resembles a legitimate monitoring component associated with Zabbix environments.
Threat actors frequently use names that resemble trusted software because administrators are accustomed to seeing monitoring agents, update services, system daemons, and other background processes.
The implant operated with root privileges through a systemd service.
It stored encrypted configuration information, communicated with external infrastructure over HTTPS, supported reverse-shell functionality, and could launch additional tooling on the compromised Linux host.
In other words, the Linux system became a persistent command-and-control platform rather than merely a temporary scanning machine.
Why Naming Matters in an Intrusion
A malicious process called something obviously suspicious is likely to attract attention.
A process called zabbixagent is a different story.
An administrator investigating a server full of monitoring software may initially assume the process belongs to legitimate infrastructure.
This is why defenders should avoid relying exclusively on process names, filenames, or service descriptions.
A process must be evaluated according to its binary location, hash, parent process, startup configuration, network behavior, privileges, file activity, and expected software inventory.
Trusting a name is not the same as verifying a binary.
Persistence Designed for Stealth
The campaign demonstrates several persistence strategies working together.
The IOS XR implant was associated with a startup path.
Another component could activate during selected hours.
The Linux implant was configured as a systemd service.
The attackers also manipulated logging and command output.
Individually, each technique could be investigated.
Together, they form a much more resilient intrusion architecture.
The attacker was not merely trying to survive a reboot. Fire Ant was attempting to survive administrator inspection and routine security monitoring.
Why Critical Infrastructure Is an Attractive Target
Critical infrastructure environments are particularly sensitive because network architecture often contains systems that cannot simply be disconnected or rebuilt.
Industrial facilities, utilities, telecommunications environments, transportation networks, government infrastructure, and other high-value environments frequently depend on specialized systems and long-lived networking equipment.
Attackers understand this.
Even when their immediate objective is espionage rather than disruption, gaining knowledge of the network can create future strategic options.
An attacker that understands how an organization is connected today may be better positioned to exploit those relationships tomorrow.
The Real Danger: Trust Abuse
The deepest lesson from the Fire Ant campaign is not simply that Cisco routers can be compromised.
It is that trusted infrastructure can become an attacker-controlled source of truth.
Organizations routinely place significant trust in routers, switches, firewalls, identity infrastructure, monitoring systems, and management platforms.
Once one of those devices is compromised, conventional assumptions begin to fail.
Logs may be incomplete.
Command output may be manipulated.
Network traffic may be monitored.
Connections may be hidden.
Legitimate-looking services may actually be malicious.
That is why network-device security needs to be treated as an essential part of endpoint and identity security.
Deep Analysis: Investigating a Potential Router Compromise
Start With Configuration Integrity
Defenders investigating suspicious Cisco IOS XR behavior should compare the running state against known-good configuration baselines.
Useful commands may include:
show running-config
show startup-config
show interfaces
show interfaces description
show ip interface brief
show route
show logging
show processes
show processes cpu
show processes memory
The goal is not simply to search for a known malicious filename.
Look for unexpected interfaces, tunnels, routes, services, processes, scheduled behavior, and discrepancies between what the router is currently doing and what administrators believe they configured.
Investigate GRE Interfaces
Unexpected GRE interfaces deserve immediate attention.
For example:
show interfaces
show running-config interface
show ipv4 interface brief
show route
A tunnel that exists operationally without an expected administrative explanation should be treated as a potential incident indicator until proven otherwise.
The investigation should also examine surrounding routing behavior and the systems connected through the tunnel.
Review Administrative History
Where available, defenders should compare current state against historical configuration backups and legitimate change records.
Useful questions include:
Who authorized the change?
When was the tunnel expected to appear?
Does the configuration exist in the approved baseline?
Does the current state differ from the stored configuration?
Are there unexplained management sessions?
Did configuration changes occur outside maintenance windows?
A mismatch between configuration management records and live router behavior should never be dismissed casually.
Examine Logging Behavior
If a router has been compromised, relying entirely on its own logs may be dangerous.
Organizations should compare router-generated events with independent telemetry.
Look for:
Unexpected configuration changes
Unexpected management logins
Authentication anomalies
Missing logging periods
Unusual outbound connections
Unexpected tunnel activity
Unexpected administrative commands
Centralized logs are particularly valuable because they provide a second source of evidence that is harder for an attacker to manipulate from the compromised device itself.
Inspect Linux Persistence
For the Linux host associated with the suspicious tunnel, defenders can examine systemd services with:
systemctl list-units --type=service --all systemctl list-unit-files systemctl status <service> journalctl -u <service> --no-pager
Investigators should pay particular attention to services that:
Execute as root
Use unusual binaries
Reside outside expected software directories
Have recently appeared
Establish outbound connections
Use names resembling legitimate software
Launch shells or secondary processes
Verify Suspicious Binaries
Do not trust filenames.
For a suspicious executable:
file /path/to/suspicious_binary sha256sum /path/to/suspicious_binary stat /path/to/suspicious_binary strings /path/to/suspicious_binary
Hash values should then be compared against the organization’s software inventory and trusted threat-intelligence sources.
Forensic analysis should ideally be performed on a preserved copy rather than modifying the original evidence.
Review Network Connections
On the Linux side, defenders can inspect active connections with:
ss -tulpn ss -tpna
Depending on the operating system and tooling available, process-to-network relationships can reveal unexpected outbound connections.
Particular attention should be given to systems that normally have little or no reason to communicate externally.
Hunt for Suspicious PCAP Activity
Because the campaign involved packet capture, defenders should search for unexpectedly created .pcap or .pcapng files.
Examples:
find / -type f ( -name ".pcap" -o -name ".pcapng" ) 2>/dev/null
Large packet captures appearing in unusual directories, particularly alongside unexpected outbound transfers, should receive immediate investigation.
Investigate FTP Transfers
FTP transfers from network infrastructure should be reviewed carefully.
Organizations should search firewall, proxy, NetFlow, DNS, and SIEM telemetry for:
Unexpected FTP sessions
Unusual outbound destinations
Large outbound transfers
Connections occurring during unusual hours
Repeated connections to unfamiliar infrastructure
Even when attackers delete local evidence, external telemetry may preserve the communication pattern.
Hunt for Zabbix Impersonation
The presence of a process or service named zabbixagent does not automatically mean it is malicious.
However, organizations using Zabbix should verify every monitoring agent against the approved software package.
Check:
systemctl status zabbix-agent systemctl cat zabbix-agent which zabbix_agentd sha256sum "$(which zabbix_agentd)"
The exact service name and executable location should be compared with the organization’s approved deployment.
Do Not Trust a Single Indicator
A sophisticated intrusion rarely depends on one artifact.
One suspicious service may be a false positive.
One unexpected tunnel may have an innocent explanation.
One unusual outbound connection may be legitimate.
But when multiple indicators appear together—such as an unexplained tunnel, altered logging, suspicious services, packet capture, unexpected outbound traffic, and reconnaissance—the probability of compromise rises dramatically.
Detection should therefore focus on relationships between indicators, not isolated artifacts.
What Undercode Say:
Routers Have Become Security-Critical Endpoints
The old distinction between “network equipment” and “security infrastructure” is becoming increasingly meaningless.
Modern routers are programmable, remotely managed, highly privileged computing systems.
They deserve endpoint-level security attention.
The Router Sees What Other Systems Cannot
A workstation sees its own traffic.
A router can potentially observe traffic flowing between entire populations of systems.
That makes router compromise especially attractive for espionage.
Logging Manipulation Is a Major Warning
The ability to suppress security messages is arguably more dangerous than simply installing a backdoor.
A backdoor provides access.
A logging bypass can help preserve that access.
Visibility Can Be More Valuable Than Disruption
Attackers do not always need to shut down infrastructure.
Understanding infrastructure can be enormously valuable.
Fire
The GRE Tunnel Is a Strong Investigation Lead
An unexpected tunnel is not automatically malicious.
But an unexplained tunnel combined with other anomalies is extremely difficult to ignore.
Network teams should know exactly why every tunnel exists.
Legacy Systems Remain Dangerous
The compromised Linux host demonstrates another recurring security problem: old systems often remain connected because replacing them is difficult.
Attackers understand that.
A forgotten Linux server can become a bridge between modern infrastructure and an adversary.
It Looks Legitimate Is Not Enough
The zabbixagent naming strategy highlights why defenders should validate software cryptographically and behaviorally.
Legitimate names are easy to copy.
Legitimate provenance is harder to fake.
Critical Infrastructure Requires Independent Telemetry
A compromised device should not be the only source of information about itself.
Network flow data, authentication logs, DNS records, firewall telemetry, endpoint telemetry, and external monitoring can provide independent evidence.
Configuration Backups Are Security Controls
Configuration backups are often treated as operational conveniences.
They are also forensic baselines.
Without historical configurations, defenders may struggle to determine when a router’s state changed.
Change Management Can Become an Attack Detection System
If a live router contains a configuration element that nobody authorized, the change-management process itself becomes a detection mechanism.
Organizations should connect configuration monitoring with security operations.
Time-Based Persistence Deserves More Attention
Malware that runs only during certain hours can evade casual observation.
Defenders should therefore investigate periodic or scheduled behavior rather than focusing exclusively on continuously running processes.
Network Devices Need Integrity Monitoring
Traditional endpoint detection products do not necessarily provide equivalent visibility into every network device.
Organizations should build dedicated monitoring around routers, switches, firewalls, and network appliances.
Management Access Is a Prime Target
If attackers gain administrative access to network infrastructure, the potential impact extends far beyond one device.
Protecting management interfaces should therefore receive the same urgency as protecting domain controllers and cloud administration consoles.
Outbound Connections From Routers Matter
Routers are expected to communicate with many systems.
But that does not mean every outbound connection is legitimate.
Unexpected external communications should be investigated, particularly from devices that should have tightly restricted management-plane connectivity.
Packet Capture Should Trigger Immediate Questions
A router unexpectedly generating packet captures should be treated as a potentially serious event.
Security teams should know which legitimate tools and administrators are authorized to capture traffic.
FTP From Trusted Infrastructure Is Particularly Interesting
Legacy protocols such as FTP deserve additional scrutiny when they appear in unexpected places.
Large packet captures being transferred externally would be especially concerning.
Root-Level Linux Services Are High Risk
A newly installed root-level systemd service has significant authority.
If its origin cannot be established, defenders should investigate it as a possible persistence mechanism.
Attackers Are Exploiting Operational Blind Spots
Cybersecurity teams often focus heavily on endpoints, email, browsers, cloud accounts, and identity providers.
Network infrastructure can receive less scrutiny.
That imbalance creates opportunities.
The Management Plane Is the Crown Jewel
Data-plane compromise is serious.
Management-plane compromise can be catastrophic.
An attacker who can manipulate routing, interfaces, logging, and administrative commands has a fundamentally different level of control.
Critical Infrastructure Should Assume Strategic Reconnaissance
Organizations protecting critical infrastructure should assume that sophisticated adversaries may be interested in mapping systems long before attempting disruption.
Reconnaissance itself can be an important stage of a larger campaign.
Zero Trust Must Include Network Devices
Zero Trust cannot stop at user identities.
It should also question whether infrastructure devices are behaving as expected.
Network Segmentation Still Matters
If a router is compromised, segmentation can limit what the attacker can see and reach.
Segmentation does not eliminate compromise, but it can dramatically reduce the blast radius.
Egress Filtering Can Break the Attack Chain
If compromised infrastructure cannot freely establish external connections, command-and-control and data exfiltration become harder.
Outbound network policy therefore deserves as much attention as inbound filtering.
Independent Monitoring Can Expose Manipulation
If the compromised router hides an event locally, external telemetry may still capture its consequences.
This is one reason independent monitoring is so important.
Threat Hunting Should Follow the Attack Path
Instead of searching only for individual malware names, defenders should reconstruct the entire chain:
Router → tunnel → Linux host → reconnaissance → external communication → potential target
That approach can reveal related compromises that a filename-based hunt would miss.
The Biggest Lesson Is About Trust
Fire Ant’s campaign demonstrates that trusted infrastructure can become an adversary’s strongest asset.
The device administrators trust to connect the network may eventually become the device helping an attacker understand it.
Defenders Need Network-Level Forensics
Forensic readiness should include network appliances.
Organizations should preserve configuration history, authentication records, management logs, flow data, and relevant telemetry.
Security Teams Should Practice Router Incident Response
Many organizations have detailed procedures for compromised laptops and servers.
Far fewer have equally mature playbooks for compromised routers.
That gap needs to close.
A Router Breach Can Become an Intelligence Operation
The
Visibility itself was valuable.
The router effectively became an intelligence collection point.
The Campaign Is a Warning for Every Network Team
This incident should not be interpreted as a Cisco-only problem.
The broader lesson applies to routers, switches, firewalls, VPN appliances, load balancers, and other privileged infrastructure.
Anything that controls or observes network traffic can become a strategic target.
Security Must Follow the Architecture
As infrastructure becomes more programmable, defenders must protect the entire computing environment rather than focusing exclusively on traditional servers and endpoints.
The network itself is now part of the attack surface.
✅ Fire Ant Activity Targeted Cisco IOS XR Infrastructure
The supplied report describes a campaign involving Cisco IOS XR routers and malicious components designed specifically for that environment.
The investigation reportedly identified an unexplained GRE tunnel and multiple forms of router manipulation.
These details are consistent with the central claim that network infrastructure itself was being used as an attack platform.
✅ The Campaign Included Network Surveillance
The attackers reportedly generated PCAP files from multiple interfaces and transferred captured traffic externally.
That means the compromise was not limited to persistence or reconnaissance.
The router was being used as a privileged observation point.
✅ A Linux-Based Component Was Used for Further Operations
The campaign also involved a Linux host connected through the suspicious tunnel.
Researchers identified a zabbixagent-named backdoor operating through systemd with root privileges and capabilities including remote shell access.
❌ The Presence of zabbixagent Alone Does Not Prove Compromise
A process or service with a familiar name is not automatically malicious.
Organizations legitimately deploy Zabbix monitoring components, so the filename must be evaluated alongside its hash, location, package provenance, service configuration, and network behavior.
❌ An Unexpected GRE Tunnel Is Not Automatically Malicious
GRE is legitimate networking technology.
The security concern arises when a tunnel cannot be explained by authorized configuration, change records, or business requirements—especially when additional compromise indicators are present.
✅ The Main Security Lesson Is Broader Than One Vendor
The campaign demonstrates a general problem affecting privileged network infrastructure.
Routers and other network appliances can provide attackers with visibility, persistence, traffic interception opportunities, and strategic access to connected environments.
Indicators of Compromise
Reported Files
The supplied intelligence identifies the following artifacts:
bin/atd
SHA1: C164BFC953C66E58B11FC280E69FD43B8F255839
Role: Custom SSH backdoor
bin/gdm
SHA1: Not provided
Role: Medusa-rootkit-related component
Important IOC Handling Note
IP addresses and domains associated with threat intelligence should remain defanged when published publicly to prevent accidental resolution or interaction.
Security teams should re-fang indicators only inside controlled environments such as their SIEM, MISP, EDR, threat-intelligence platform, or malware-analysis infrastructure.
Defensive Detection Strategy
Build a Trusted Router Baseline
Maintain known-good snapshots of router configurations, interface inventories, routing tables, software versions, and approved services.
Any unexplained deviation should generate an investigation.
Monitor Configuration Changes
Configuration changes should be correlated with administrator identity, ticket numbers, maintenance windows, and approved change requests.
Unexpected modifications should never be treated as ordinary noise.
Monitor Management Access
Track administrative access to network infrastructure from unusual locations, unusual accounts, unusual times, or previously unseen devices.
Multi-factor authentication and dedicated management networks should be used wherever supported.
Restrict Network Egress
Network devices should have tightly controlled outbound access.
A router that can freely communicate with arbitrary external infrastructure gives a compromised attacker considerably more freedom.
Protect Telemetry From the Device Itself
Forward logs and telemetry to independent systems and monitor the health of the telemetry pipeline itself.
A sudden disappearance of expected events can be an indicator rather than simply a logging problem.
Hunt Across the Entire Environment
If one router is compromised, investigate connected routers, Linux hosts, management systems, authentication infrastructure, and critical network segments.
Attackers rarely stop at the first useful foothold.
Prediction
(+1) Network Infrastructure Security Will Become a Much Bigger Priority
The most likely positive development is that incidents like this will force organizations to treat routers, switches, firewalls, and other network appliances as first-class security endpoints.
More enterprises will begin implementing configuration integrity monitoring, stronger management-plane isolation, independent telemetry, stricter egress controls, and dedicated incident-response procedures for network infrastructure.
(+1) Independent Telemetry Will Become Standard Practice
Organizations will increasingly recognize that compromised infrastructure cannot be trusted to report accurately on its own behavior.
External flow monitoring, centralized logging, configuration snapshots, and network detection systems will become increasingly important for identifying stealthy compromises.
(-1) Attackers Will Continue Moving Toward Trusted Infrastructure
The negative side of the prediction is equally important.
As endpoint defenses improve, sophisticated threat actors have a strong incentive to target the infrastructure sitting underneath those endpoints.
Routers, VPN gateways, firewalls, hypervisors, identity platforms, and cloud control planes could increasingly become attractive targets because compromising them can provide visibility that individual endpoints cannot.
(+1) Network Devices Will Receive More Threat-Hunting Attention
Security operations teams are likely to expand their hunting programs beyond laptops and servers.
The next generation of mature SOC operations will increasingly ask not only “Which endpoint was compromised?” but also “Can we still trust the infrastructure carrying the organization’s traffic?”
Final Takeaway: The Device Everyone Trusts Can Become the Perfect Spy
The Router Is No Longer Just a Router
Fire Ant’s campaign illustrates a disturbing reality of modern cyberwarfare: the most dangerous compromise may not begin with an employee opening a malicious attachment or clicking a phishing link.
It may begin with the infrastructure that everyone assumes is trustworthy.
A compromised router can observe traffic, hide configuration changes, manipulate logs, provide persistence, create covert tunnels, and help attackers map the systems around it.
Visibility Is Power
The attackers did not need to immediately destroy the network.
They first needed to understand it.
That is why the combination of router compromise, hidden tunneling, traffic capture, logging manipulation, Linux persistence, and reconnaissance is so significant.
The campaign shows how a single trusted infrastructure component can become an attacker’s eyes, ears, and operational bridge.
The Defensive Message Is Clear
Organizations should know what every network device is configured to do, who is allowed to manage it, where it can communicate, what telemetry it produces, and what legitimate software should exist on it.
Anything outside that baseline deserves scrutiny.
Because when an attacker controls the network layer, the question is no longer simply whether the network is compromised.
The question becomes whether the network can still be trusted.
Tighten the article’s repeated analysis
Separate confirmed facts from inference
▶️ Related Video (78% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
