It started with a tunnel that should not have been there. Investigators from the incident response firm Sygnia were examining a Cisco IOS XR router when they found an active GRE tunnel interface that neither the running configuration nor the commit history could account for. Following it led them to an intrusion in which a group they call Fire Ant had taken over the routers, the servers that authenticate network administrators and the Linux hosts used to manage it all.
Sygnia published its findings on Monday. Fire Ant is an espionage group with links to China that the company first described in July 2025, when it was breaking into VMware ESXi and vCenter systems. The new report shows the same actor moving down a layer, from the virtualization platform to the network equipment underneath it.
A router that watches
The malware on the routers was written specifically for IOS XR, not adapted from a generic Linux implant. It kept itself alive through a fake system service that only ran the implant in alternating hours. One component replaced a system library so that outgoing log messages were checked before being forwarded, and only those containing a particular marker were sent on. Another changed how commands were executed, so that an administrator looking at the device's configuration would not see the attacker's tunnel. The implant also opened outbound Telnet connections to the attackers and gave them an interactive shell that left no log entries.
With that level of control, Fire Ant used the routers to record traffic. Packet captures were taken on several Cisco devices and uploaded to FTP servers outside the network. Captures like these can reveal how a network is laid out, who administers it and from where, how logins flow and what passes to neighboring networks. In Sygnia's description, the router stopped being a device that moves traffic and became one that collects it.
The hidden tunnel connected one of the routers to an old Linux server that the group used as a staging point. From there it probed machines in connected networks, among them systems associated with critical infrastructure, on the ports used for SSH, web services, Windows file sharing and remote desktop. Sygnia says it saw scanning and connection attempts against those networks, not a confirmed compromise. It calls the approach going after the target behind the target: break into a trusted intermediary and use its connections to reach the organization that actually matters.
Stealing the administrators' passwords
On the TACACS server, which checks the credentials of people logging in to network devices, the investigators found a set of tools they named TacTap. An injector loaded a malicious library into the running tac_plus authentication process, where it intercepted new connections and handed the live sessions to a second process. The credentials it captured were then written to a hidden file in lightly scrambled form. Sygnia says it is not aware of this injection technique having been described publicly before.
A second new tool, a Linux backdoor called BridgeAgent, was installed on the staging server. It posed as an agent for the Zabbix monitoring system, ran as a root service, and reached out to the attackers on port 443, using TLS, to fetch commands and open reverse shells. Elsewhere on the Linux management hosts the group relied on two rootkits whose source code is public, Medusa and REPTILE, on SSH backdoors of its own making, and on programs renamed and given altered timestamps so that they looked like the SentinelOne and Cybereason security agents. Some of these had been planted in 2025 and were used again this year.
Fire Ant also put real effort into destroying evidence. It suppressed router logs, SNMP traps and authentication requests, switched off SELinux on the Linux hosts, rewrote login history and removed records of privileged commands.
Who and how
Sygnia says the activity overlaps strongly with UNC3886, a Chinese espionage group documented by Mandiant that is known for targeting virtualization platforms and network devices. It stops short of a firm attribution. It was also unable to determine how the attackers first got onto the router.
The company's advice to investigators is to treat routers, TACACS servers, hypervisors and jump hosts as forensic evidence in their own right, and never to trust logs from a compromised device without checking them against memory, disk, network and configuration data. Its report includes indicators of compromise and detection rules for the tools involved.
