Fire Ant

Mentions · 7d0
Mentions · 30d0
All mentions5
First seenAug 31, 2026
Last mentionedSep 10, 2026

Timeline

5 articles · newest first

CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

CISA adds actively exploited Cisco, Citrix, and Fortinet edge-device flaws to KEV catalog, ordering federal agencies to patch by September 12, 2026.

The Hacker NewsSep 10, 10:36 UTC · Sep 10, 2026Exploit / PoCExploitedCVE-2026-20079 CVE-2026-19490 CVE-2025-252492 · 1 read

China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks

Sygnia links the China-nexus Fire Ant campaign to UNC3886, showing hackers weaponized compromised Cisco IOS XR routers for espionage and wider intrusions.

The RecordSep 1, 20:41 UTC · Sep 1, 2026Threat actor1

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

The Hacker NewsSep 1, 16:45 UTC · Sep 1, 2026Threat actorExploitedCVE-2026-81578 CVE-2026-82078 CVE-2026-74232+24 · 1 read

China-linked Fire Ant Hides Inside Trusted Infrastructure

China-linked Fire Ant backdoored Cisco IOS XR routers, injected TACACS libraries to steal credentials, and rewrote logs across infrastructure targets.

Security AffairsAug 31, 11:10 UTC · Aug 31, 2026Threat actorExploited3 · 1 read

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.

The Hacker NewsAug 31, 09:04 UTC · Aug 31, 2026Threat actorExploited2

Related CVEs

by mentions

CVE-2026-2007988%10.0
Authentication bypass to root access in Cisco Secure Firewall Management Center
published Mar 4, 2026Cisco Secure Firewall Management Center (FMC) Software (web interface)KEVPoC ×2
CVE-2025-252494%9.8
Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
published Jan 13, 2026Fortinet FortiOSKEVPoC
CVE-2026-8207861%9.4
Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
published Aug 28, 2026PaperCut NGKEV
CVE-2026-1949033%9.3
Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
published Aug 19, 2026Citrix NetScaler ADC and NetScaler GatewayKEVPoC
CVE-2026-8157884%8.8
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
published Aug 28, 2026PaperCut MFKEV
CVE-2026-74232<1%9.3
Backdoor implant in Zbtlink and MoreQuick routers allows unauthenticated root access
published Aug 27, 2026Zbtlink L3_V2_8
CVE-2026-66747<1%9.3
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line
published Aug 5, 2026
CVE-2026-742333%9.3
Unauthenticated Root Command Injection in Zbtlink (ZBT) Router infosrvd Service
published Aug 27, 2026Zbtlink WE1326

Appears with

Sygniavendor · 4
UNC3886threat actor · 4
Ciscovendor · 4
Cisco IOS XRproduct · 4
SentinelOnevendor · 2
Volt Typhoonthreat actor · 2
Sygniaorganization · 2
Salt Typhoonthreat actor · 2
Cisco Secure Firewall Management Centerproduct · 1
PivotC2malware · 1
VulnCheckvendor · 1
FBIorganization · 1
Previdianvendor · 1
QTFYthreat actor · 1
Huntressvendor · 1
VMware ESXiproduct · 1

Entities are extracted by the model from each article. First seen Aug 31, 2026, last mentioned Sep 10, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.