A China-linked espionage group that incident response firm Sygnia tracks as Fire Ant has moved from VMware hypervisors to the network layer. It’s now compromising Cisco IOS XR routers, TACACS authentication servers and Linux management hosts, and using them to watch traffic and collect credentials, BleepingComputer reported.
Sygnia spotted the activity after finding an active GRE tunnel interface on an IOS XR router that didn’t show up in the running configuration or commit history. Further analysis turned up custom malware. It persisted through a fake system service that ran the implant only during alternating hours, selectively suppressed syslog messages that would reveal the tunnel, opened outbound Telnet connections to Fire Ant infrastructure and offered interactive shell access with no logging.
Routers as collection points
The attackers captured traffic from multiple routers and uploaded the PCAP files to external FTP servers. Captures like that can reveal internal topology, administrative connections, authentication flows and routing relationships. “This behavior shifts the router’s role from a transit device to a collection platform,” Sygnia wrote. “When a threat actor controls routers, they do not only gain reach. They gain perspective,” the researchers added, as quoted by The Record.
The hidden GRE tunnel connected one router to a legacy Linux server that Fire Ant used for staging and reconnaissance. From there, the group probed systems in connected high-value environments, including ones tied to critical infrastructure, over SSH, web, SMB/RPC and RDP ports. Sygnia calls this approach “target behind the target”: take over trusted infrastructure at one organization and use it as a covert bridge into the networks connected to it.
On TACACS servers, which authenticate administrators and log their commands, the group harvested credentials as they were used. On Linux hosts, Sygnia found a previously undocumented backdoor, BridgeAgent, disguised as a Zabbix monitoring agent. It runs as a root-level systemd service and supports TLS reverse shells and running additional payloads.
“Fire Ant didn’t just compromise systems. It compromised the trust layer those systems depend on,” said Asaf Perlman, Sygnia’s director of incident response. Sygnia didn’t name the victims.
Attribution and detection
Sygnia said Fire Ant overlaps strongly with UNC3886, a Chinese espionage group documented by Google’s Mandiant, though filenames, paths and implementation details differ. The group tampers heavily with logs and changes file timestamps, so Sygnia warned that logs pulled from compromised devices should be checked against other data sources. Its report includes indicators of compromise along with hunting and YARA rules.
The findings follow years of warnings about Chinese groups targeting Cisco gear, from Volt Typhoon’s attacks on end-of-life routers to Salt Typhoon’s campaign against telecom networks. Sygnia’s recommendation is to treat routers, hypervisors and authentication servers as forensic assets that need monitoring, hardening and incident response plans.
WebProNews is an iEntry Publication