China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks
Sygnia links the China-nexus Fire Ant campaign to UNC3886, showing hackers weaponized compromised Cisco IOS XR routers for espionage and wider intrusions.
Sygnia's Fire Ant report details Chinese hackers compromising Cisco IOS XR routers, TACACS+ authentication servers and management infrastructure to capture traffic, harvest credentials and stage attacks on high-value and critical infrastructure networks. The group, which overlaps with Mandiant's UNC3886, developed custom router malware for persistence, hid logs, deleted files and tampered with firewall rules, and remained active in 2026 after Sygnia's 2025 disclosure. The activity aligns with prior Chinese campaigns against Cisco devices, including Volt Typhoon and Salt Typhoon operations.
- Custom malware gave Fire Ant persistence and control of Cisco IOS XR routers
- TACACS+ server compromise enabled credential harvesting and admin activity observation
- Traffic capture across multiple routers provided network-wide vantage points
- Actors deleted files, hid logs and tampered with firewall rules to evade forensics
- Fire Ant overlaps with Mandiant-tracked group UNC3886
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1040 Network SniffingT1078 Valid AccountsT1070 Indicator RemovalT1562.001 Impair Defenses: Disable or Modify Tools
- Products
- Cisco IOS XR
- Threat actors
- Fire AntUNC3886Volt TyphoonSalt Typhoon
- Countries
- China
From the original article
4 min read at therecord.media
China-based hackers used an array of methods to compromise popular Cisco routers and use them as a jumping off point to monitor organizations, steal credentials and break into other organizations. In its latest report on a hacking operation it calls “Fire Ant,” cybersecurity firm Sygnia detailed a string of breaches that alarmed defenders due to its sophistication and effectiveness.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.