Kiran 
A China-nexus espionage group tracked as Fire Ant has quietly evolved from hijacking virtualization hosts into commandeering the very infrastructure that keeps enterprise networks running routers, authentication servers, and Linux management systems according to new research from incident-response firm Sygnia.
First documented in 2025, the group remained active through 2026, and its latest campaign shows a threat actor no longer content with breaching individual machines. It is now colonizing the connective tissue of entire networks.
Sygnia’s investigation began with a small anomaly: a GRE tunnel interface active on a Cisco IOS XR router with no matching configuration or commit history to explain it.
Fire Ant Hackers Hijack Routers, TACACS Servers
That single discrepancy unraveled a much larger operation. Fire Ant had built custom malware specifically for the IOS XR control plane, embedding a boot-themed persistence script disguised as a legitimate service under /etc/rc.d/init.d/grub-rommon.
The implant, nicknamed for its host process acpidRan on a deliberate odd-hour/even-hour schedule to dodge routine inspection, and it selectively suppressed syslog messages unless they contained the string “Health,” effectively editing the router’s own memory of events.
Perhaps the most consequential discovery was on the TACACS authentication server, the chokepoint that validates administrator logins across network devices.
Sygnia identified a toolset it calls TacTap, consisting of an injector binary (acppid) and a malicious shared object (libseconfd.so) loaded into the tac_plus process itself.
By hooking accept and accept4 calls, the malware intercepted live authentication sessions and passed connection handles to the injector via a Unix socket, ultimately writing harvested credentials to an XOR-encrypted file.
Sygnia notes this specific library-injection technique against tac_plus has not been publicly documented before a genuine tradecraft evolution.
Following the rogue GRE tunnel led investigators to a legacy Linux system running a fake Zabbix agent, which Sygnia named BridgeAgent.
The implant masqueraded its process as gnome-shell, stored AES-encrypted configuration at /opt/.ICEauthority, and polled external infrastructure over HTTPS for reverse-shell commands.
From this foothold, Fire Ant conducted port scans against SSH, RDP, and SMB services on connected high-value networks, including systems tied to critical infrastructure, confirming the campaign’s “target behind the target” logic.
“What makes Fire Ant genuinely dangerous isn’t any single backdoor; it’s the decision to attack the layer defenders trust the most. When you compromise the router that carries the traffic and the server that authenticates the administrator, you haven’t just gained access; you’ve corrupted the evidence defenders would use to find you. That’s a fundamentally harder problem than malware removal; it’s a crisis of forensic trust.
Fire Ant’s anti-forensic discipline extended across every compromised layer. On Linux hosts, the actor rewrote wtmp, utmp, and btmp login records to hide the router’s real IP address, stripped sudo entries from /var/log/secure, and disabled SELinux outright.
Sygnia assesses a strong overlap with previously documented UNC3886 tradecraft, including reused VMCI backdoors and a REPTILE-derived packet-triggered implant that shares UNC3886’s “kill marker” string, even as filenames and activation triggers were altered.
Sygnia’s four-phase model control, collect, build access, conceal argues that routers, TACACS servers, and jump hosts must now receive endpoint-grade monitoring and forensic readiness.
As the report bluntly concludes, when trusted infrastructure is compromised, attackers gain not just a foothold but the power to make that infrastructure tell an incomplete story.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
