China-linked Fire Ant Hides Inside Trusted Infrastructure
China-linked Fire Ant backdoored Cisco IOS XR routers, injected TACACS libraries to steal credentials, and rewrote logs across infrastructure targets.
Sygnia reports the China-linked espionage group Fire Ant compromised Cisco IOS XR routers with purpose-built malware, injected a library into the TACACS authentication daemon to capture live credential material, and manipulated syslog so only messages containing 'Health' were logged. The group used GRE tunnel interfaces with no commit history, rewrote wtmp/utmp/btmp login records, and deployed dormant deep backdoors on Linux systems — one disguised as a SentinelOne agent, another activated by raw network traffic carrying a magic string. Code-level overlap with UNC3886 tooling suggests evolution of that China-nexus cluster's TACACS credential-collection techniques, and Fire Ant used compromised infrastructure to scan SSH, RDP and web ports toward high-value networks.
- Custom IOS XR malware hooks logging, execution, and routing
- TACACS daemon library injection captured live login credentials
- Syslog filtered to log only messages containing 'Health'
- Backdoor activated via magic string in raw network traffic
- Backdoors dormant since 2025, disguised as SentinelOne agent
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1554 Compromise Client Software BinaryT1562.001 Impair Defenses: Disable or Modify ToolsT1070.001 Clear Windows Event LogsT1078 Valid Accounts
- Vendors
- CiscoSygniaSentinelOne
- Products
- Cisco IOS XRTACACS
- Organizations
- Sygnia
- Countries
- China
From the original article
5 min read at securityaffairs.com
Fire Ant hijacked Cisco routers, stole credentials and altered logs to hide its tracks, using trusted infrastructure to reach high-value networks. Chinese-linked cyber espionage group Fire Ant has spent the past year quietly graduating from hacking individual computers to hacking the infrastructure that connects them.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.