A China-linked cyber espionage group, known as Fire Ant, has expanded its long-running campaign from VMware environments to Cisco IOS XR routers, TACACS authentication servers and Linux management hosts, according to cybersecurity firm Sygnia.
The attackers used compromised Cisco routers as network monitoring points, allowing them to capture traffic, collect credentials and hide malicious activity from security teams. Researchers found a suspicious GRE tunnel on one Cisco IOS XR router, which led them to a Linux system used for network scanning and connection attempts.
Fire Ant also deployed malware specifically designed for the Cisco IOS XR control plane. It modified a system library to filter outgoing log messages and altered the router's command-execution process to hide the attacker's tunnel configuration from administrators. The group also intercepted packet captures (PCAPs) from Cisco devices and transferred them to external FTP servers.
On a TACACS+ authentication server, Sygnia discovered a credential-stealing toolkit called TacTap. An injector named acppid loaded a malicious library into the running tac_plus process. The library intercepted incoming authentication sessions and passed session data to another process through a Unix socket. Stolen credentials were stored in /var/log/.tacplus.acct and obfuscated using a single-byte XOR key.
Researchers also found a Linux backdoor called BridgeAgent, disguised as a Zabbix monitoring agent, which maintained persistence through a systemd service running with root privileges. The malware disguised its process as /usr/bin/gnome-shell and communicated with attacker infrastructure over TLS on port 443.
Fire Ant used additional tools to maintain access to Linux management systems, including the open-source Medusa and REPTILE rootkits and custom SSH backdoors. Some malicious binaries were renamed and timestamped to resemble legitimate SentinelOne and Cybereason security-agent files.
“Across routers, TACACS servers, and Linux hosts, the actor modified or bypassed telemetry sources defenders normally rely on, reinforcing the need to validate logs against memory, disk, network, authentication, and configuration evidence,” the report notes.
Sygnia said the campaign overlaps with publicly reported activity associated with UNC3886, a China-nexus espionage group known for targeting virtualization platforms and network infrastructure. However, the company didn’t make a definitive attribution.