In a significant development within cybersecurity, the China-linked threat actor known as Fire Ant has notably expanded its espionage operations. Initially focused on VMware hypervisors, Fire Ant has shifted its attention to the trusted infrastructure layer, effectively compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. This transformation marks a strategic pivot, emphasizing the targeting of infrastructure-control-plane assets rather than simply conventional endpoints.
Security firm Sygnia, which conducted extensive investigations into Fire Ant’s activities, reported that the group has remained active since its first identification in 2025. This persistence raises considerable alarm among cybersecurity experts and organizations that depend on these critical systems for secure network operations. Fire Ant’s sophisticated maneuvers demonstrate a calculated approach in compromising high-value targets that lie at the core of organizational trust and operational efficiency.
One of the most alarming aspects of Fire Ant’s operations is the deliberate takeover of infrastructure components, such as routers and servers responsible for authentication. By gaining control over Cisco IOS XR routers, for instance, the group has been able to modify their operational environment, thereby ensuring persistence through covert communications, traffic collection, and anti-forensics measures. This capability not only provides strategic visibility into crucial network paths and administrator sessions but also exposes sensitive credentials and intricate cross-environment trust relationships.
Investigators discovered unexplained GRE tunnel interfaces activated on affected routers, which do not align with the devices’ running configurations. This situation casts considerable doubt on the integrity of the routers’ configurations and audit views, rendering them untrustworthy. Adding a further layer of complexity, the group utilized a variety of techniques to obscure its activities. For instance, their toolkit included a persistence script disguised as a legitimate boot-related service and an implant named “acpid,” which was designed to minimize its presence and evade detection by reducing continuous process visibility.
Moreover, Fire Ant’s malware embedded a modified IOS XR syslog library that skillfully suppressed log events containing the word “Health.” This manipulation allowed Fire Ant to present a misleading picture of system performance while suppressing potentially incriminating evidence from being logged or audited. In this fashion, the attackers tailored command outputs so that malicious activities, including tunnel configurations, were hidden from network administrators.
The ability of Fire Ant to extract packets from compromised routers further exemplifies the group’s sophisticated techniques. They executed administrative workflows to collect packet capture (PCAP) files, which were subsequently uploaded to their own external FTP servers. Such traffic collection can reveal not only the network topology and management communications but also the intricacies of authentication flows, routing dynamics, and overall traffic patterns across connected environments.
Additionally, Fire Ant actively targeted TACACS servers, a crucial authentication chokepoint designed to control and audit administrative access to network devices. In one case, a credential-theft toolkit known as TacTap was identified on an affected system. TacTap included a malicious shared library that was stealthily injected into the running TACACS process, allowing the malware to intercept newly accepted administrative connections. This vulnerability illustrates how attackers can weaponize trusted systems that validate access to critical infrastructure, consequently undermining the security measures that these systems are supposed to uphold.
In a chilling revelation of their tactics, the attackers leveraged compromised systems not just as victims but as platforms for mapping and collecting intelligence from other connected networks. This strategy underscores the potential for Fire Ant to serve as a bridge into networks and systems that are deemed high-value targets.
Organizations in the cybersecurity landscape are now faced with urgent calls to action. It is recommended that they rigorously validate router logs, authentication records, configuration states, and other telemetry against one another, rather than relying on a singular source. The tradecraft exhibited by Fire Ant is designed specifically to create confusion, making logging, command outputs, and audit trails unreliable. Consequently, trusted infrastructure components must now be considered high-value targets that warrant extreme scrutiny.
In summary, the actions of Fire Ant illustrate a significant evolution in cyber threats, with organizations requiring a multi-faceted approach in defending against such malicious actors. As the company Sygnia aptly notes, the intersection of compromised infrastructure and malicious intent creates a perilous environment for organizational security, necessitating an urgent and astute response from the cybersecurity community.