Reported by 3 outlets

Timeline

1. original reporting

   Chinese Fire Ant hackers turn Cisco routers into spying platforms

   bleepingcomputer.com · 43d ago · August 31st, 2026

   The researchers discovered Fire Ant's new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history. According to incident response company Sygnia, the threat actor switched from targeting VMware hypervisors to compromising Cisco routers, TACACS authentication servers, and Linux management hosts. The researchers discovered Fire Ant's new tactic after finding on a Cisco IOS XR router an active GRE (Generic Routing Encapsulation) tunnel interface that could not be explained by a running configuration or commit history. Further analysis revealed that Fire Ant had deployed custom malware on the devices, enabling persistence through a fake system service that ran the implant only during alternating hours. The malware selectively suppressed syslog messages to hide tunnel-related information from legitimate administrators, established outbound Telnet connections to Fire Ant infrastructure, and supported interactive shell access with no logging. Fire Ant's evasion tactics Source: Sygnia The attackers also used their administrative access to capture traffic from multiple routers and upload the resulting PCAP files to external FTP servers. These captures could expose internal topology, administrative connections, authentication flows, routing relationships, and traffic exchanged with connected networks. “This behavior shifts the router’s role from a transit device

2. update from gbhackers.com

   Fire Ant Hackers Compromise Cisco Routers and TACACS Servers to Target Critical Infrastructure

   gbhackers.com · 42d ago · September 1st, 2026

   China-nexus threat actor Fire Ant has expanded its espionage operations from VMware hypervisors to the trusted infrastructure layer, compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. Security firm Sygnia, which investigated the activity, said Fire Ant has remained active since it was first reported in 2025. The actor’s latest operations show […] The post Fire Ant Hackers Compromise Cisco Routers and TACACS Servers to Target Critical Infrastructure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   Hackers Turn Cisco Routers Into Spy Platforms to Reach Critical Infrastructure

   cyberpress.org · 42d ago · September 1st, 2026

   A China-linked threat actor known as Fire Ant has compromised Cisco IOS XR routers and other trusted infrastructure to spy on networks, steal credentials, maintain hidden access, and explore routes toward critical infrastructure. The campaign shows how attackers can use routers not only to move traffic, but also as surveillance and attack platforms. The interface was active, but there was no matching configuration or commit history to explain how it had been created. This suggested that the router’s operational state had been altered while normal administrative records were manipulated or hidden. Fire Ant deployed several malicious components designed specifically for the IOS XR environment. One implant was placed in a startup path and disguised as a legitimate service. It launched another component during selected hours, allowing the malware to remain persistent while reducing the chance of being noticed during routine checks. It selectively prevented messages from being forwarded, which suppressed important security events. Another component manipulated command execution and added filters to router output. BridgeAgent execution flow: persistence through zabbix_agent.service, command-line masquerading as