Fire Ant: China-Nexus APT Hijacks Cisco IOS XR Routers and TACACS+ Servers to Spy on Critical Networks

Your network infrastructure just became the attacker’s favourite hiding place. On 31 August 2026, incident-response firm Sygnia released a landmark report documenting how Fire Ant — a China-nexus advanced persistent threat group with strong overlaps to the notorious UNC3886 — silently transformed Cisco IOS XR routers, TACACS+ authentication servers, and Linux management hosts into long-lived espionage platforms. The group did not exploit a loud remote-code-execution flaw. It walked in quietly, rewired your trusted infrastructure, and made sure you could not find the evidence.

For Indian enterprises, this matters acutely. Critical-sector organisations — telecom, banking, defence contractors, and government — run exactly the kind of high-value, multi-vendor network fabric that Fire Ant systematically hunts. And because the group targets the management plane rather than the data plane, your perimeter firewalls and EDR agents are largely blind.

From Hypervisors to Routers: Fire Ant’s Expanding Kill Chain

Sygnia first disclosed Fire Ant in July 2025, at which point the group was targeting VMware ESXi and vCenter environments — a pattern consistent with campaigns documented by Mandiant under the UNC3886 moniker, which previously deployed a TACACS+ sniffer called LOOKOVER and backdoored tac_plus daemons. The 2026 campaign marks a deliberate pivot up the stack: rather than continuing to burrow into virtualisation hosts, Fire Ant moved into the network and management plane — the very layer that controls, routes, and authenticates everything else.

The strategic logic is elegant and terrifying. Compromise a Cisco IOS XR core router and you sit on the wire for every packet crossing the network. Compromise the TACACS+ server and you collect the credentials every administrator types when they SSH into any managed device. Compromise the Linux jump host and you have a staging post that most organisations classify as “trusted” by default, exempting it from the same scrutiny applied to endpoints.

This is “target behind the target” strategy — a technique Sygnia explicitly names in its report. The compromised router becomes a covert bridge into adjacent networks that Fire Ant has not yet touched.

Technical Deep Dive: Three Tools, One Invisible Footprint

1. The Phantom GRE Tunnel

Sygnia’s investigation began with an anomaly that should alarm every network operations team: a Generic Routing Encapsulation (GRE) tunnel interface on a Cisco IOS XR router that appeared in the running configuration but had no corresponding commit history. The interface connected the compromised router to a legacy Linux server used for staging and reconnaissance. Fire Ant then modified system libraries to filter any syslog messages referencing the string "Health" — suppressing the very telemetry that would reveal the tunnel’s activity — and appended | exclude filters to command output so the tunnel could not be seen in normal CLI queries.

2. TacTap — Stealing Every Password in Real Time

The most technically significant element of the campaign is TacTap, a credential-harvesting toolkit that Sygnia notes has “not been publicly described before.” Its components:

Component	Path	Function
Injector	/usr/sbin/acppid	Hooks TACACS+ authentication processes
Malicious library	/lib/libseconfd.so	Intercepts live authentication session handles
Credential store	/var/log/.tacplus.acct	Writes harvested credentials with single-byte XOR (key: 0xEF)

Every administrator who authenticates to a managed device via TACACS+ has their credentials silently captured. Because TACACS+ is the backbone of network-device authentication in most enterprise environments — used for routers, switches, firewalls, and load balancers — TacTap effectively gives Fire Ant the master key to the entire network within days of deployment.

3. BridgeAgent — The Backdoor That Looks Like a Monitor

BridgeAgent is a previously undocumented Linux backdoor that persists as a root-level systemd service disguised as a Zabbix monitoring agent — exactly the kind of process that NOC teams see every day and habitually trust. On disk, the binary masquerades as /usr/bin/gnome-shell. Over the network, it communicates over TLS port 443, blending into normal HTTPS traffic. It supports TLS reverse shells and the delivery of additional payloads, providing Fire Ant with persistent, encrypted command-and-control on management hosts.

Complementing BridgeAgent are open-source rootkits REPTILE and Medusa, custom SSH backdoors, binaries impersonating SentinelOne and Cybereason security agents, and a packet-triggered backdoor that activates when TCP traffic arrives on ports 443, 541, 8443, or 10443.

Evidence Erasure: The Forensic Nightmare

What makes Fire Ant exceptionally dangerous is not just its toolset but its systematic destruction of evidence. The group:

• Suppressed router syslog messages, SNMP traps, and authentication requests
• Disabled SELinux on compromised Linux hosts
• Rewrote login history records and removed privileged command entries from system logs
• Maintained backdoors in memory after deleting files from disk, surviving initial forensic triage
• Exfiltrated full packet captures from Cisco devices to attacker-controlled FTP servers stood up the same day as the upload

Sygnia’s advice is direct: never rely on a single telemetry source. Investigators must cross-validate logs against memory artefacts, disk images, network flow data, authentication records, and device configuration history simultaneously.

The UNC3886 Thread — and Why It Points to China

Sygnia stops short of a conclusive attribution but documents “strong overlaps with public reporting on UNC3886” — a Chinese espionage group previously tracked by Google’s Mandiant unit for targeting virtualisation platforms and network edge devices. Mandiant documented UNC3886 deploying LOOKOVER, a TACACS+ sniffer, in earlier campaigns; TacTap appears to be a functional successor, with a novel library-injection approach not previously seen publicly. The group’s operational pattern — targeting network management infrastructure, using legitimate-looking tools, and operating in alternating-hour windows to evade detection — is consistent with state-sponsored, long-duration intelligence collection rather than financial crime.

The parallel with Salt Typhoon, another China-linked group that targeted telecommunications carrier routers in 2024-2025, is difficult to ignore. Both groups understood that controlling the wire is more valuable than owning any single endpoint.

What You Should Do: An Expert’s Zero-Trust Response

As a zero-trust and NOC/SOC practitioner working with enterprises across India and the wider region, I want to be direct: your network management plane is almost certainly under-protected. Here is a prioritised action list.

1. Audit GRE/IP-in-IP tunnel interfaces today. Run show interfaces and cross-check against your change-management database and commit history on every IOS XR device. Any tunnel with no commit history is a critical finding.
2. Inspect TACACS+ daemon integrity. Hash-verify tac_plus binaries and all linked libraries against known-good baselines. Audit /var/log/ for hidden dot-files. Check /usr/sbin/ for unexpected binaries.
3. Review systemd services on Linux management hosts. Verify that every service claiming to be Zabbix, SentinelOne, Cybereason, or any other security tool matches the expected binary hash and file path.
4. Enforce zero-trust access to the management plane. No administrator should reach a router CLI directly from a workstation. Mandate MFA + privileged access workstations + session recording, and segment TACACS+ servers into a dedicated management VLAN with strict ACLs.
5. Deploy network-layer telemetry. Enable NetFlow / IPFIX on all core routers and forward to your SIEM. Anomalous GRE or FTP traffic from management subnets is a high-fidelity detection signal. Complement with Sygnia’s published YARA rules and IOCs for BridgeAgent and TacTap.
6. Treat SELinux state as a canary. If SELinux is disabled on a Linux management host and no authorised change ticket exists, assume compromise and isolate immediately.
7. Rotate ALL network-device credentials. If your TACACS+ server was reachable from the internet — or from any less-trusted segment — assume TacTap may have been present and rotate credentials for every device in scope.

For organisations running FortiGate or mixed-vendor perimeter environments, remember that a compromised IOS XR router upstream can intercept traffic destined for or originating from your FortiGate management interface — making the TACACS+ credential harvest even more dangerous if the same AAA server services your Fortinet estate.

Sygnia has also documented Fire Ant conducting reconnaissance from compromised routers using SSH, HTTP, SMB/RPC, and RDP — meaning any host reachable from your core routing layer is potentially exposed. A layered, zero-trust segmentation approach — where the management plane is fully isolated and every session is logged and recorded — is no longer optional.

India & Asia-Pacific: Why You Are in the Crosshairs

While Sygnia’s report does not name specific countries, Fire Ant’s predecessor activity (UNC3886) has been documented targeting organisations in the Asia-Pacific region, including telecommunications providers, defence contractors, and critical-infrastructure operators. India’s telecom sector — which runs large Cisco IOS XR deployments across its backbone — and its rapidly expanding government digital infrastructure represent high-value targets for intelligence collection. The TACACS+ credential harvest is particularly concerning for multi-tenant environments where a single compromised AAA server can yield credentials for dozens of clients.

India’s CERT-In has not yet issued a specific advisory on Fire Ant as of this writing. Organisations should not wait — apply Sygnia’s YARA signatures and IOCs now and engage your managed security service provider for an emergency threat-hunt across network-device management infrastructure.

Frequently Asked Questions

How is Fire Ant different from a typical network intrusion?

Most intrusions target endpoints or servers. Fire Ant targets the infrastructure that manages everything else — routers, authentication servers, and jump hosts. This means standard EDR and endpoint telemetry is largely blind to the activity. Detection requires router-level forensics, library-integrity checks, and management-plane traffic analysis.

Does this affect FortiGate or only Cisco devices?

The confirmed compromise in Sygnia’s report involves Cisco IOS XR routers and Linux-based TACACS+ servers. However, if your FortiGate, Juniper, or other devices authenticate via the same TACACS+ server that Fire Ant has compromised, their credentials are equally at risk. The credential-harvesting is at the authentication-server level, not the device OS level.

What YARA rules and IOCs has Sygnia released?

Sygnia published YARA signatures for BridgeAgent and TacTap, file-path and hash indicators for the malicious libraries and binaries, and network-level IOCs including FTP server addresses and GRE tunnel characteristics. These are available in the full Sygnia research report and have also been aggregated by The Hacker News and BleepingComputer.

Is this linked to Salt Typhoon or other known Chinese APT groups?

Sygnia assesses “strong overlaps” with UNC3886 (tracked by Mandiant/Google). UNC3886 is distinct from Salt Typhoon (UNC2286), though both groups target network infrastructure and are assessed as China-nexus. The tactical overlap — TACACS+ interception, router backdooring, log suppression — suggests shared tooling or doctrine rather than a single unified group.

---

Is your network management plane ready for a Fire Ant-style intrusion? Most organisations discover they are not — only after the attacker has collected months of credentials and packet captures. Sanjay Seth works with enterprises across India and the region to design and audit zero-trust management-plane architectures, deploy comprehensive NOC/SOC telemetry, and validate that your authentication infrastructure cannot be weaponised against you.

Request a management-plane security assessment →