Fire Ant Hackers Compromise Cisco Routers and TACACS Servers to Target Critical Infrastructure

China-nexus threat actor Fire Ant has expanded its espionage operations from VMware hypervisors to the trusted infrastructure layer, compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts.

Security firm Sygnia, which investigated the activity, said Fire Ant has remained active since it was first reported in 2025.

The actor’s latest operations show a deliberate shift toward infrastructure-control-plane assets rather than conventional endpoints.

By taking over routers, authentication servers, and management systems, the group gained strategic visibility into network paths, administrator sessions, credentials, and cross-environment trust relationships

Fire Ant compromised Cisco IOS XR routers and modified their operational environment to support persistence, covert communications, traffic collection, and anti-forensics.

Investigators found an unexplained GRE tunnel interface that was active on an affected router despite having no matching running configuration or commit-history record, indicating that administrators could no longer trust the device’s own configuration and audit views.

The router toolkit included a persistence script masquerading as a legitimate boot-related service and an implant named acpid, which was launched intermittently to reduce continuous process visibility.

The malware embedded a modified IOS XR syslog library that selectively suppressed log events containing the string “Health,” returning a success-like result without forwarding the events to the normal logging pipeline.

Fire Ant also manipulated command output. Reverse engineering showed that a malicious component modified the IOS XR command-execution path to append exclusion filters to show commands, hiding tunnel-related details such as VRF, tunnel source, destination, and interface configuration.

This capability enabled the attackers to obscure malicious network state directly from administrators using the router CLI.

The compromised routers were also used for packet capture. Fire Ant executed router-administration workflows using a legitimate account to collect PCAP files from multiple interfaces, then uploaded the captures to external FTP infrastructure.

Router-based traffic collection can expose network topology, management communications, authentication flows, routing relationships, and traffic patterns across connected environments.

The attackers simultaneously targeted TACACS servers, a critical authentication chokepoint used to control and audit administrative access to network devices.

On one affected system, Sygnia identified a credential-theft toolset called TacTap, comprising an injector at /usr/sbin/acppid and a malicious shared library, /lib/libseconfd.so.

TacTap injected the malicious library into the running tac_plus process and hooked the accept and accept4 functions.

This placed the implant directly in the live TACACS session-handling path, allowing it to intercept newly accepted administrative connections.

Sygnia Researchers said that, the campaign demonstrates how attackers can weaponize the systems that route traffic, validate administrator access, and preserve security telemetry to reach connected high-value and critical-infrastructure environments.

The implant then passed connection file descriptors to the collection process through the local Unix socket /var/run/acpid.lock.

Fire Ant Campaign

Captured credential material was written to /var/log/.tacplus.acct and lightly obfuscated using a single-byte XOR key, 0xEF.

The binary contained a hardcoded external IP address and Telnet client functionality, while importing IOS XR-specific routing, VRF, RIB, and Telnet-management libraries. 

The technique gives Fire Ant access to credentials while undermining confidence in the same authentication infrastructure defenders use to determine who accessed critical systems and what commands they performed.

Sygnia also found Fire Ant using a GRE-connected Linux management host as an active reconnaissance and staging node.

The host performed repeated connection attempts and port probing against systems associated with high-value and critical-infrastructure environments, including SSH, web, SMB/RPC, and RDP services.

The investigation did not confirm compromise of those downstream targets; observed activity was limited to scanning and connection attempts.

A backdoor tracked as BridgeAgent masqueraded as a Zabbix monitoring component.

Persisted through a zabbix_agent.service unit, it ran with root privileges, changed its visible command line to resemble /usr/bin/gnome-shell, decrypted configuration from /opt/.ICEauthority, and polled attacker-controlled infrastructure over TLS on port 443.

The central risk is what Sygnia describes as the “target behind the target.”

Fire Ant appears to be using compromised organizations not merely as victims, but as trusted infrastructure platforms from which to map, collect from, and potentially access connected networks.

Routers, TACACS servers, hypervisors, jump hosts, and management appliances are therefore no longer peripheral operational assets; they are high-value targets that can expose entire trust chains.

Organizations should validate router logs, authentication records, configuration state, network telemetry, disk evidence, and memory artifacts against one another rather than relying on a single source.

Fire Ant’s tradecraft specifically aims to make logging, command output, and audit trails incomplete or misleading turning trusted infrastructure into both an access layer and an unreliable witness.

IOCs

filename	SHA1	Role/Description
/bin/atd	C164BFC953C66E58B11FC280E69FD43B8F255839	Custom SSH backdoor
/bin/gdm	—	Medusa-rootkit-related component
/usr/sbin/cupsdd	1aa6ab2006b5d9199aa87bb0bbd995aec698ac4f	Custom SSH backdoor.
/usr/sbin/smartdd	c164bfc953c66e58b11fc280e69fd43b8f255839	Medusa rootkit binary.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide