60
60
60
60
30
60
60
60
55
57
60
China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks
Sygnia links the China-nexus Fire Ant campaign to UNC3886, showing hackers weaponized compromised Cisco IOS XR routers for espionage and wider intrusions.
Sygnia's Fire Ant report details Chinese hackers compromising Cisco IOS XR routers, TACACS+ authentication servers and management infrastructure to capture traffic, harvest credentials and stage attacks on high-value and critical infrastructure networks. The group, which overlaps with Mandiant's UNC3886, developed custom router malware for persistence, hid logs, deleted files and tampered with firewall rules, and remained active in 2026 after Sygnia's 2025 disclosure. The activity aligns with prior Chinese campaigns against Cisco devices, including Volt Typhoon and Salt Typhoon operations.
70
47
60
60
60
60
60
60
42
60
60
60
60
60
60
60
55
60
60
47
42
55
Alert: Juniper Firewalls, Openfire, and Apache RocketMQ Under Attack from New Exploits
60
60
60
60
60