Search: “tacacs”

33 stories

China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.

Sygnia investigated an intrusion in which Fire Ant expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts. The actor deployed purpose-built router implants that hid a GRE tunnel, filtered log messages, captured PCAPs uploaded to external FTP servers, and used TacTap to inject a library into tac_plus and steal TACACS credentials obfuscated with a single-byte XOR key of 0xEF. A Linux backdoor named BridgeAgent masqueraded as a Zabbix agent, persisted via a root systemd unit, disguised itself as /usr/bin/gnome-shell and received commands over TLS on port 443. The group also used Medusa and REPTILE rootkits, SSH backdoors and renamed binaries impersonating SentinelOne and Cybereason agents, while suppressing logs, disabling SELinux and rewriting login history. Sygnia assesses strong overlap with UNC3886 and published IoCs.

The Hacker NewsAug 31, 09:04 UTC · 16d agoThreat actor in the wild1

China-linked Fire Ant Hides Inside Trusted Infrastructure

China-linked Fire Ant backdoored Cisco IOS XR routers, injected TACACS libraries to steal credentials, and rewrote logs across infrastructure targets.

Sygnia reports the China-linked espionage group Fire Ant compromised Cisco IOS XR routers with purpose-built malware, injected a library into the TACACS authentication daemon to capture live credential material, and manipulated syslog so only messages containing 'Health' were logged. The group used GRE tunnel interfaces with no commit history, rewrote wtmp/utmp/btmp login records, and deployed dormant deep backdoors on Linux systems — one disguised as a SentinelOne agent, another activated by raw network traffic carrying a magic string. Code-level overlap with UNC3886 tooling suggests evolution of that China-nexus cluster's TACACS credential-collection techniques, and Fire Ant used compromised infrastructure to scan SSH, RDP and web ports toward high-value networks.

Security AffairsAug 31, 11:10 UTC · 16d agoThreat actor in the wild

Weathering the storm: In the midst of a Typhoon

Cisco TalosFeb 20, 13:00 UTC · Feb 20, 2025Vulnerability CVE-2018-0171 CVE-2023-20198 CVE-2023-20273+1 CVEs

Portnox unveils new cloud-native tool to help midmarket businesses simplify network security

Help Net SecurityJun 17, 00:00 UTC · Jun 17, 2022Industry

Russian state-sponsored espionage group Static Tundra compromises unpatched end-of

Cisco TalosAug 20, 13:00 UTC · Aug 20, 2025Vulnerability CVE-2018-0171

State-sponsored campaigns target global network infrastructure

Cisco TalosApr 18, 15:02 UTC · Apr 18, 2023Threat actor CVE-2017-6742

Cisco Issues Patch for Critical Enterprise NFVIS Flaw — PoC Exploit Available

The Hacker NewsSep 4, 07:07 UTC · Sep 4, 2021Exploit / PoC CVE-2021-34746 CVE-2021-1577 CVE-2021-1585

Salt Typhoon Exploits Flaws in Edge Network Devices to Breach 600 Organizations Worldwide

The Hacker NewsSep 5, 12:40 UTC · Sep 5, 2025Threat actor CVE-2018-0171 CVE-2023-20198 CVE-2023-20273+3 CVEs

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.

The Hacker NewsSep 1, 16:45 UTC · 14d agoThreat actor in the wildCVE-2026-81578 CVE-2026-82078 CVE-2026-74232+2 CVEs1

NSA, NCSC, and allies detailed TTPs associated with Chinese APT actors targeting critical infrastructure Orgs

Security AffairsAug 28, 10:48 UTC · Aug 28, 2025Exploit / PoC CVE-2024-21887 CVE-2023-46805 CVE-2024-3400+3 CVEs1

Cisco fixes 3 high-severity DoS flaws in NX

Security AffairsAug 27, 15:00 UTC · Aug 27, 2023Exploit / PoC in the wildCVE-2023-20200 CVE-2023-20169 CVE-2023-20168+2 CVEs

Patched: Critical bug with public PoC exploit in Cisco infrastructure virtualization software (CVE-2021-34746)

Help Net SecuritySep 3, 00:00 UTC · Sep 3, 2021Exploit / PoC CVE-2021-34746

China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks

Sygnia links the China-nexus Fire Ant campaign to UNC3886, showing hackers weaponized compromised Cisco IOS XR routers for espionage and wider intrusions.

Sygnia's Fire Ant report details Chinese hackers compromising Cisco IOS XR routers, TACACS+ authentication servers and management infrastructure to capture traffic, harvest credentials and stage attacks on high-value and critical infrastructure networks. The group, which overlaps with Mandiant's UNC3886, developed custom router malware for persistence, hid logs, deleted files and tampered with firewall rules, and remained active in 2026 after Sygnia's 2025 disclosure. The activity aligns with prior Chinese campaigns against Cisco devices, including Volt Typhoon and Salt Typhoon operations.