Threats · 57 days ago
Sygnia said Fire Ant has moved beyond VMware and into Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts, with activity observed in 2026. The group used that foothold to collect network traffic, steal credentials, suppress telemetry, and keep access alive.
The mechanism is the trust layer itself: once the actor controls routers and centralized authentication, it can watch traffic as it crosses the network, interfere with login flow, and hide the evidence defenders would normally use to reconstruct what happened. Sygnia also saw attempts against connected high-value environments, but it did not confirm those were breached.
That leaves a response problem as much as a containment problem. If IOS XR routers or TACACS sit in the path for admin access and routing, a clean-looking device log may already be part of the intrusion, and the exposure can extend into the records used to prove what else was reached.
6 sources covering this story
The Record from Recorded Future
China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks
A hacking operation dubbed Fire Ant "didn’t just compromise systems," according to researchers.
China-linked hackers turn Cisco routers into covert attack infrastructure
Fire Ant’s compromise of TACACS servers and manipulation of router telemetry shows how control of core network systems can leave defenders with incomplete evidence while exposing paths toward sensitive connected networks.
New Sygnia report highlights Fire Ant risks from compromised routers and authentication systems in critical infrastructure sectors.
State-linked actor targets Cisco routers for espionage
An actor known as Fire Ant has expanded its reach into trusted environments, with unique tooling and stealth.
Chinese Fire Ant hackers turn Cisco routers into spying platforms
The researchers discovered Fire Ant's new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history.
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
Fire Ant compromises Cisco IOS XR routers and TACACS servers to capture traffic, harvest credentials, and suppress defensive telemetry.
Part of the PlainSec briefing for 2026-09-02