China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
China-linked Fire Ant espionage group expanded its campaign from VMware hypervisors to compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts The group deployed purpose-built router malware that suppressed security logs by filtering for the string "Health" and hid tunnel configurations using command-execution path manipulation A novel credential-harvesting tool called TacTap used library injection into tac_plus authentication processes, with credentials obfuscated via single
Analysis
TL;DR
- China-linked Fire Ant espionage group expanded its campaign from VMware hypervisors to compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts
- The group deployed purpose-built router malware that suppressed security logs by filtering for the string "Health" and hid tunnel configurations using command-execution path manipulation
- A novel credential-harvesting tool called TacTap used library injection into tac_plus authentication processes, with credentials obfuscated via single-byte XOR (key 0xEF)
- A second new implant, BridgeAgent, masqueraded as a Zabbix monitoring agent while running as root and communicating over TLS on port 443
- The actor built a durable access layer using Medusa and REPTILE rootkits, custom SSH backdoors, and binaries impersonating SentinelOne and Cybereason endpoint protection agents
Why It Matters
This campaign demonstrates how threat actors are increasingly targeting network infrastructure devices—routers and authentication servers—as high-value collection platforms rather than stopping at endpoint compromise. For AI and security practitioners, it underscores the critical need to treat network edge devices and management infrastructure as first-class forensic assets, since controlling routers provides both reach into connected networks and visibility into all traffic traversing trusted paths.
Technical Details
- Router Malware (Cisco IOS XR): Purpose-built for the IOS XR control plane, not generic Linux. One component embedded a modified system library that inspected outgoing log messages for the string "Health" and forwarded them only when present, effectively blinding defenders. Another component altered the command-execution path to automatically append an
| excludefilter toshowcommands, hiding the attacker's GRE tunnel configuration from administrators. - TacTap Credential Harvesting: An injector named
acppidloaded a malicious library (/lib/libseconfd.so) into the runningtac_plusauthentication process. The library hooked connection-acceptance functions and passed live session handles to a second process over a local Unix socket. Captured credentials were written to/var/log/.tacplus.acctand obfuscated with a single-byte XOR key of0xEF. Sygnia noted this specifictac_pluslibrary-injection technique had not been publicly described before. - BridgeAgent Linux Backdoor: Deployed on a tunnel-connected legacy Linux host, this implant persisted via a
zabbix_agent.servicesystemd unit running as root. It disguised its process as/usr/bin/gnome-shell, stored encrypted configuration at/opt/.ICEauthority, and polled attacker infrastructure over TLS on port 443 for commands and reverse-shell instructions. - Durable Access Layer: Across Linux management hosts, Fire Ant deployed the open-source Medusa and REPTILE rootkits, custom SSH backdoors, and binaries renamed and timestamped to impersonate SentinelOne and Cybereason endpoint security agents. At least one backdoor maintained memory residency after its disk files were deleted, with components planted in 2025 and reused for 2026 operations.
- Anti-Forensics: The actor suppressed router logs, SNMP traps, and authentication requests; disabled SELinux on Linux hosts; rewrote login-history records; and removed privileged command entries from system logs. Packet captures (PCAPs) were exfiltrated via external FTP servers, one of which was installed on the same day as the uploads.
Industry Insight
- Network infrastructure devices (routers, TACACS servers, hypervisors) must be prioritized in threat hunting and incident response playbooks; they should be treated as equal forensic assets alongside endpoints and servers, with log validation spanning memory, disk, network, authentication, and configuration evidence rather than relying on any single telemetry source.
- The evolution of Fire Ant's tradecraft—particularly the novel
tac_pluslibrary injection and the use of legitimate monitoring agent identities for C2—suggests state-sponsored actors are continuously refining their persistence and credential-theft techniques; defenders should monitor for anomalous systemd services, unexpected library injections into authentication daemons, and process name impersonation of security tools. - The overlap with UNC3886 reporting but lack of conclusive attribution highlights the importance of maintaining independent threat intelligence analysis; organizations should assess their Cisco IOS XR, VMware, and TACACS infrastructure against the published IoCs regardless of attribution certainty, and consider network segmentation that limits router compromise from cascading into high-value environment access.
Disclaimer: The above content is generated by AI and is for reference only.