Adversary Intelligence — 2026-09-01

China-Linked Fire Ant Group Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

BLUFFire Ant's pivot from hypervisors to authentication and routing infrastructure positions the group to move laterally across trust boundaries that connected organizations assume are intact.

Sygnia disclosed on August 30 that a China-nexus actor it tracks as Fire Ant compromised Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts, expanding beyond the group's 2025 campaign against VMware ESXi and vCenter environments 1. Investigators found two new tools: BridgeAgent, a Zabbix-masquerading implant used for tunneling and persistence, and TacTap, a credential-collection toolset that intercepted authenticated TACACS sessions 1. Sygnia's Asaf Perlman told Cybersecurity Dive the investigation began after an unexplained generic routing encapsulation tunnel was found active on a router with no corresponding entry in its running configuration or commit history 2. The actor also deleted files post-execution, disabled SELinux, suppressed AAA and SNMP logging, and altered firewall rules on compromised Linux hosts to limit forensic evidence 13. Sygnia did not identify the victim organization's industry or location 2.

Analysis
The intrusion reaches past a single victim into the authentication and routing trust layer other networks depend on, giving Fire Ant a foothold usable against connected environments rather than a contained breach. Deleted files, disabled SELinux, and suppressed AAA and SNMP logging on Linux management hosts and TACACS servers degrade administrators' own audit trails, so organizations running similar Cisco IOS XR and TACACS architectures may already be compromised without corroborating evidence to detect it. The shift from VMware hypervisors in 2025 to authentication and routing infrastructure in 2026 marks a deliberate pivot toward chokepoints offering reach beyond the initial target; the tradecraft could equally reflect a financially motivated access broker mimicking state methods to boost resale value. Reporting rests entirely on Sygnia's own investigation, with other outlets relaying its findings rather than independently corroborating them.

5 sources

Sygnia Reveals New Activity by China-Nexus Threat Actor Fire Ant Targeting Trusted Infrastructure
State-linked actor targets Cisco routers for espionage - Cybersecurity Dive
Chinese Fire Ant hackers turn Cisco routers into spying platforms - BleepingComputer
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs - The Hacker News
Fire Ant Evolves: From Hypervisors to Trusted Infrastructure - Sygnia