Fire Ant, a China-linked threat actor, has pivoted from VMware hypervisors to Cisco IOS XR routers and TACACS authentication servers. Sygnia researchers found routers embedded in trusted segments survive far longer than endpoint breaches; they’re rarely removed.
The key innovation is selective syslog suppression. Fire Ant suppresses only specific traffic types, like GRE tunnel telemetry, staying invisible while harvesting credentials. They’ve engineered precision into log hiding, targeting exactly what defenders monitor.
Using “BridgeAgent” (disguised as a Zabbix monitoring agent), they maintain root-level access and capture credentials at the router layer before authentication systems even see them.
This shifts the threat model. Defenders watching authentication logs for breaches miss the harvesting happening at the network boundary. A compromised hypervisor can be reimaged; a router collecting traffic in a trusted segment persists far longer.
Sources: Fire Ant Evolves: From Hypervisors to Trusted Infrastructure • Sygnia Blog Post
Coverage: China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Logs • Chinese Fire Ant Hackers Turn Cisco Routers Into Spying Platforms
Related on this blog: [AUTO] First Autonomous AI Attack on Critical Infrastructure • FortiBleed Ran on a Command Fortinet Ships in the Box • [AUTO] Security Tools as First-Strike Targets