A China-linked espionage group known as Fire Ant has turned compromised Cisco IOS XR routers into surveillance platforms, capturing network traffic, stealing login credentials, and disabling the logging systems that security teams depend on to detect attacks, according to a new investigation published by incident response firm Sygnia in August 2026. The firm traced the operation beyond VMware hypervisors—Fire Ant's previously documented target—to include routers, TACACS authentication servers, and Linux management hosts used to oversee high-value networks. Sygnia assessed that the hackers used their position to scan and probe connected critical infrastructure environments, though the firm said activity against those systems stopped short of confirmed compromise.

The intrusion began with an unexplained tunnel interface running on a Cisco IOS XR router with no configuration or commit history to explain how it was created. Investigators traced the tunnel to a legacy Linux system, from which Fire Ant launched repeated connection attempts and port scans targeting administrative and service ports—including SSH, HTTP, SMB, and RDP—across connected networks. The router malware was custom-built for the IOS XR control plane, not adapted from generic Linux tools. One component embedded a modified system library that filtered outgoing log messages, forwarding only those containing the string "Health." A separate component altered the router's command-execution path to append an "| exclude" filter to show commands, hiding the attacker's tunnel configuration from administrators inspecting the device. Fire Ant then used the routers to capture packet data from multiple Cisco devices and uploaded the captures to external FTP servers, one of which appeared to have been set up the same day the uploads occurred. On the TACACS server, Sygnia identified a credential-theft toolset it tracks as TacTap. An injector named acppid loaded a malicious library into the running tac_plus authentication process, hooked the functions that accept new connections, and passed live session handles to a second process over a local Unix socket. The stolen credentials were written to /var/log/.tacplus.acct and lightly obfuscated with a single-byte XOR key of 0xEF. Across the Linux management hosts, Fire Ant built a durable access layer using the open-source Medusa and REPTILE rootkits, custom SSH backdoors, and binaries renamed and timestamped to impersonate SentinelOne and Cybereason endpoint security agents. Several of these components were planted in 2025 and reused for hands-on activity in 2026. At least one backdoor kept running in memory after its file had been deleted from disk.

Sygnia assessed that the activity strongly overlaps with public reporting on UNC3886, a China-nexus espionage group known for targeting virtualization platforms and network edge devices, though the firm stopped short of conclusive attribution. Mandiant, which first documented UNC3886, has said it found no technical overlap between that group and the separate Chinese operations tracked as Salt Typhoon and Volt Typhoon. "To our knowledge, this specific tac_plus library-injection technique has not been publicly described before, making it a notable evolution of Fire Ant's TACACS-focused credential collection tradecraft," the firm wrote. The report notes that credential theft from TACACS servers is established tradecraft for the cluster, as Mandiant previously documented UNC3886 deploying a TACACS+ sniffer called LOOKOVER and replacing the tac_plus daemon with a backdoored version to log credentials. Controlling the routers gave the actor a vantage point over traffic moving through trusted network paths. "This activity reinforces one of the core observations from the investigation: when a threat actor controls routers, they do not only gain reach. They gain perspective," the firm said.

The actor worked to undermine the evidence itself by suppressing router logs, SNMP traps, and authentication requests; disabling SELinux on the Linux hosts; rewriting login-history records; and removing entries for privileged commands from system logs. Sygnia said routers, TACACS servers, hypervisors, and jump hosts should be treated as first-class forensic assets, and that investigators should validate logs against memory, disk, network, authentication, and configuration evidence rather than relying on a single telemetry source. The firm published indicators of compromise including the TacTap injector, the BridgeAgent backdoor, IOS XR implants, and a packet-triggered backdoor that activates on specific TCP and UDP ports when triggered by the string "sxcdewqaz!@#." The full indicator set and YARA rules are available in Sygnia's report. The 2026 activity follows the firm's July 2025 disclosure of Fire Ant, which detailed the group's exploitation of VMware ESXi and vCenter environments before moving into the network and management layers. Defenders who assume their edge infrastructure is read-only or too hardened to backdoor may find themselves blindsided by adversaries who've already rewritten the rules at the kernel level. Organizations that treat routers as appliances rather than endpoints are effectively handing sophisticated actors both the keys and the surveillance equipment.