China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.
Sygnia investigated an intrusion in which Fire Ant expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts. The actor deployed purpose-built router implants that hid a GRE tunnel, filtered log messages, captured PCAPs uploaded to external FTP servers, and used TacTap to inject a library into tac_plus and steal TACACS credentials obfuscated with a single-byte XOR key of 0xEF. A Linux backdoor named BridgeAgent masqueraded as a Zabbix agent, persisted via a root systemd unit, disguised itself as /usr/bin/gnome-shell and received commands over TLS on port 443. The group also used Medusa and REPTILE rootkits, SSH backdoors and renamed binaries impersonating SentinelOne and Cybereason agents, while suppressing logs, disabling SELinux and rewriting login history. Sygnia assesses strong overlap with UNC3886 and published IoCs.
- Compromised IOS XR routers were turned into collection platforms with custom control-plane implants
- TacTap injects a library into tac_plus to capture TACACS credentials, XOR-obfuscated with 0xEF
- BridgeAgent backdoor masquerades as a Zabbix agent with TLS 443 C2 and reverse-shell capability
- Medusa and REPTILE rootkits plus SSH backdoors maintained durable access on Linux hosts
- Sygnia assesses strong overlap with China-nexus espionage group UNC3886
- ATT&CK
- T1040 Network SniffingT1554 Compromise Client Software BinaryT1562.001 Impair Defenses: Disable or Modify ToolsT1070 Indicator RemovalT1036.005 Masquerading: Match Legitimate Name or Location
- Threat actors
- Fire AntUNC3886Salt TyphoonVolt Typhoon
- Countries
- China
From the original article
4 min read at thehackernews.com
A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.