Sygnia said Fire Ant has moved beyond VMware and into Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts, with activity observed in 2026. The group used that foothold to collect network traffic, steal credentials, suppress telemetry, and keep access alive.
The mechanism is the trust layer itself: once the actor controls routers and centralized authentication, it can watch traffic as it crosses the network, interfere with login flow, and hide the evidence defenders would normally use to reconstruct what happened. Sygnia also saw attempts against connected high-value environments, but it did not confirm those were breached.
That leaves a response problem as much as a containment problem. If IOS XR routers or TACACS sit in the path for admin access and routing, a clean-looking device log may already be part of the intrusion, and the exposure can extend into the records used to prove what else was reached.
China-linked hackers turn Cisco routers into covert attack infrastructure
Fire Ant’s compromise of TACACS servers and manipulation of router telemetry shows how control of core network systems can leave defenders with incomplete evidence while exposing paths toward sensitive connected networks.