Fire Ant Extends Operations: Cisco IOS XR Routers, TACACS, and Linux Hosts Under Invisible Control

Sygnia, an incident response firm, has documented an intrusion attributed to Fire Ant that expands the operations of the China-linked cyber-espionage group well beyond VMware ESXi and vCenter virtualization platforms. The campaign, active between 2025 and 2026, now includes Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts. These are the systems used to route, authenticate, and administer high-value networks.

An Invisible GRE Tunnel on Cisco IOS XR Routers

The investigation started from an anomaly on a Cisco IOS XR router: a GRE tunnel was active without any configuration in the running-config and no trace in the commit history. Sygnia did not establish the initial access vector to the router. Following the tunnel, investigators identified a legacy Linux system from which Fire Ant performed repeated connection attempts and scans against administrative and service ports on connected networks, including SSH, HTTP, SMB, and RDP.

The malware implanted on IOS XR routers was developed specifically for the IOS XR control plane; it is not a generic Linux binary. One component incorporates a modified system library that inspects every outgoing log message and forwards it only if it contains the string "Health". All others are dropped. A second component alters the command execution path to add an "| exclude" filter to show commands, hiding the tunnel configuration from administrators. Fire Ant used the compromised routers to capture PCAP files from multiple Cisco devices, uploading them to external FTP servers. One of these servers was installed on the same day as the upload.

According to Sygnia, the routers became platforms for collecting traffic, credentials, and suppressed telemetry, giving the actor visibility into flows traversing trusted network paths. Activity against connected high-value networks, including critical infrastructure, remained limited to scans and connection attempts, with no confirmed compromise.

TacTap: Credential Theft from TACACS Servers

On TACACS servers, Sygnia identified TacTap, a toolset for credential collection. The injection technique is new: an injector located in /usr/sbin/acppid loads a malicious library into the tac_plus process. The library hooks the functions that accept new connections and passes session handles to a second process via a local Unix socket. Captured credentials are written to /var/log/.tacplus.acct and obfuscated with single-byte XOR using key 0xEF.

Sygnia notes that this specific injection technique into tac_plus had never been publicly described before and represents an evolution of Fire Ant's TACACS credential collection. Credential theft from TACACS servers is not new for the group: Mandiant had already documented for UNC3886 the TACACS+ sniffer LOOKOVER and the replacement of the tac_plus daemon with a backdoored version.

BridgeAgent and Linux Rootkits: Mimetic Persistence on Management Hosts

Sygnia also recovered BridgeAgent, a Linux backdoor deployed on the host reached via the tunnel and disguised as a Zabbix monitoring agent. It persists through the systemd unit zabbix_agent.service running as root, camouflages the process as /usr/bin/gnome-shell, and contacts the actor's infrastructure over TLS on port 443 to receive commands and reverse shell instructions.

On Linux management hosts, Fire Ant built a durable access layer using the open-source rootkits Medusa and REPTILE, custom SSH backdoors, and renamed binaries with altered timestamps to impersonate SentinelOne and Cybereason agents. Several components were implanted in 2025 and reused for manual activity in 2026. At least one backdoor continued running in memory after the file was deleted from disk.

Anti-Forensics and Impact: Erased Evidence and High Risk

The actor suppressed router logs, SNMP traps, and authentication requests, disabled SELinux on Linux hosts, rewrote login history, and removed privileged command entries from system logs. These actions reduce defenders' ability to reconstruct the attack. In terms of severity, control of routers, TACACS servers, and management hosts represents a high risk to confidentiality and integrity, even though observed activity against critical infrastructure did not progress beyond scanning and connection attempts.

Attribution and Context

Sygnia assesses strong overlap with public reporting on UNC3886, the Chinese espionage group known for attacks on virtualization platforms and network edge devices. However, it does not make a conclusive attribution. Mandiant, which first documented UNC3886, stated the absence of technical overlaps with the separate Chinese clusters Salt Typhoon and Volt Typhoon. The 2026 activity follows Sygnia's July 2025 disclosure on Fire Ant, related to the exploitation of VMware ESXi and vCenter and subsequent movement toward network and management layers. In parallel, a joint CISA-led advisory from August 2025 attributed to Salt Typhoon the collection of traffic from routers and TACACS+ to steal credentials in telecommunications networks.

Indicators and Recommendations for Defenders

Sygnia recommends treating routers, TACACS servers, hypervisors, and jump hosts as first-order forensic assets. For incident reconstruction, logs should be validated by cross-referencing memory, disk, network, authentication, and configuration, avoiding reliance on a single telemetry source. The full report includes indicator sets and YARA rules.

Key indicators of compromise include:

• TacTap: injector /usr/sbin/acppid (SHA1 36005f5e4398a1c62a2a9271eddfcc1b44b1ad00); injected library /lib/libseconfd.so (955cd45a2f6f226a2fdf44b329af1c8dde90cb38); credentials file /var/log/.tacplus.acct, decoded with XOR 0xEF.
• BridgeAgent: persistence via zabbix_agent.service; encrypted configuration /opt/.ICEauthority; C2 TLS port 443.
• IOS XR implants: /usr/bin/acpid (be6b27f429324a4af05a310d8ec9635e37c68a94); /pkg/bin/dhcpd_show_issu_status (1682b652a15bde732489f22809b0b7594c228fd3); /pkg/bin/hd (b149fa3a34bd585e7a674a4fd9538437bd06f514); persistence script /etc/rc.d/init.d/grub-rommon.
• VMCI backdoor: /var/tmp/audit (13f0c2a598e3aa63856c032a96b110aed963f0e8), communicates via VMware Virtual Machine Communication Interface socket.
• Packet-activated backdoor: /var/tmp/ping (5ba1242050b5b447052b210788a5a25593d6987d), activates on TCP ports 443, 541, 8443, 10443 and with UDP source 40443 toward destination 500, with trigger string sxcdewqaz!@#.

Specific product versions involved were not disclosed. Sygnia did not indicate whether the exploited vulnerabilities are present in the CISA KEV catalog. The report focuses on tooling and post-exploitation techniques rather than individual CVEs.