Fire Ant Expands Into Routers and Authentication Infrastructure

What changed in the 2026 activity

On August 30, 2026, incident-response firm Sygnia disclosed a new phase of activity by the China-nexus threat actor it tracks as Fire Ant. The campaign moved beyond the VMware ESXi and vCenter persistence reported in 2025 and into the infrastructure that routes traffic, authenticates administrators, and manages connected environments. Cisco IOS XR routers, TACACS servers, and Linux management hosts became a coordinated access and collection layer rather than isolated targets.

That shift matters because these systems form the trust foundation of enterprise networks. Routers determine reachability, TACACS infrastructure validates administrative access and records commands, and management hosts provide paths into multiple systems. By controlling all three, Fire Ant could collect traffic and credentials, maintain covert access, and explore routes toward connected high-value environments.

The trusted-infrastructure attack path

Sygnia reconstructed a path from Cisco IOS XR routers through a GRE tunnel to a legacy Linux system and onward toward connected networks. Investigators first noticed a tunnel interface that was operational even though the visible configuration and commit history did not explain it. That mismatch became a key clue: the router's apparent configuration could no longer be assumed to reflect its real operating state.

The Linux host on the far side of the tunnel was used for repeated connection attempts and port probing against SSH, web services, SMB/RPC, and RDP in connected high-value environments. Fire Ant installed BridgeAgent, a backdoor masquerading as a Zabbix component. It persisted through a systemd service running as root, disguised its command line, read encrypted configuration, polled an external controller over HTTPS, and launched additional tooling.

Routers as collection platforms

Fire Ant used compromised routers as intelligence collection points. Packet captures were created on multiple Cisco routers and uploaded to external FTP infrastructure. Router-level PCAP data can reveal topology, management connections, authentication flows, and relationships between connected networks. The actor also deployed IOS XR-specific components for persistence, outbound communications, selective syslog suppression, and command-output manipulation.

The toolset included a boot-themed persistence script, a modified logging flow that could suppress selected messages, router-native communication capabilities, and logic that appended exclusion filters to show commands. Defenders reviewing only the device's own configuration and logs could therefore receive an incomplete view. Router state should be corroborated with external telemetry, independent configuration snapshots, memory evidence, network sensors, and centralized logging.

Compromising the TACACS trust boundary

Fire Ant also compromised the TACACS authentication layer. Sygnia named the multi-component credential collection toolset TacTap. An injector placed a malicious shared library inside the running tac_plus process, intercepted accepted sessions, handed connection file descriptors to a companion process through a local Unix socket, and wrote TACACS-related credential material to an obfuscated hidden file. Sygnia described this specific tac_plus library-injection method as newly documented tradecraft.

A compromised TACACS system undermines more than passwords. It weakens confidence in authorization and command-accounting records across network devices. Fire Ant combined credential collection with suppression of AAA requests, SNMP traps, and router logs. Investigators should validate the authentication server itself, loaded libraries, local sockets, hidden artifacts, and independent router records.

Long-lived access and manipulated evidence

The Linux management layer showed durable persistence. Components deployed in 2025, including Medusa-related tooling and custom SSH backdoors, were reused during hands-on activity in 2026. The actor used filenames that resembled legitimate daemons, paths that imitated monitoring or endpoint-security software, timestamp manipulation, and deleted-but-running execution. This makes process, socket, memory, and service-state evidence essential alongside disk inspection.

Sygnia also recovered a packet-triggered backdoor that activated after detecting specific markers in selected TCP or UDP traffic. The report notes functional and code-level overlap with REPTILE-style tooling previously associated with UNC3886, while continuing to track the observed operation as Fire Ant. Tool similarity is useful intelligence, but it should remain separate from a definitive attribution judgment.

Investigation and defense priorities

Start by treating network and authentication infrastructure as first-class forensic assets. On IOS XR routers, compare live operational state, stored configuration, commit history, interfaces, VRFs, and unexpected GRE tunnels. Correlate PCAP creation, FTP transfers, unusual Telnet activity, and command filters with NetFlow, firewall, central syslog, and network-sensor data from adjacent segments.

On TACACS servers, review unexpected libraries loaded into tac_plus, local Unix sockets, hidden credential artifacts, service-account activity, and administrative sessions. On Linux management hosts, prioritize masquerading services, hidden configuration under system paths, processes running from deleted files, and repeated outbound TLS connections. When evidence of compromise appears, replace affected credentials, keys, and sessions, then revalidate every connected administrative path.

• Compare router operational state with stored configurations and commit history.
• Trace GRE tunnels, VRFs, PCAP creation, and FTP transfers on a common timeline.
• Inspect TACACS process injection, hidden files, and Unix-socket activity.
• Correlate Linux services, memory-resident processes, and outbound connections.
• Rotate administrative credentials and reapprove access across connected environments.

Why the campaign matters

Organizations in telecommunications, finance, manufacturing, government, and critical infrastructure often share routing, authentication, and management paths across business units, data centers, vendors, and IT/OT boundaries. The Fire Ant investigation shows how those relationships can turn one compromise into a bridge toward other environments. Applicability should be assessed from actual connectivity and administrative trust, not from a product inventory alone.

The central lesson is that the trust layer can itself become the attack surface. Router output, authentication logs, and Linux file listings may each appear normal while contradicting one another or external telemetry. Those discrepancies are valuable evidence. Continuous configuration integrity checks, centralized and independent logging, memory-aware response procedures, and shorter-lived administrative credentials can reduce the time an infrastructure-focused actor remains hidden.