Your edge routers are not just network devices. To a China-nexus espionage group called Fire Ant, they are surveillance platforms, credential harvesters, and covert tunnels into every environment they connect.
Fire Ant, tracked by incident response firm Sygnia since early 2025, has expanded its campaign from VMware hypervisors to Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. The group now hijacks the infrastructure that routes, authenticates, and administers high-value networks, turning trusted systems into attack infrastructure that can reach beyond the initial victim into connected organizations.
The 2026 findings, reported by Sygnia on August 31, represent an evolution of a campaign that began with deep persistence in virtualization infrastructure. Fire Ant previously exploited CVE-2023-34048 for unauthenticated remote code execution on VMware vCenter and CVE-2023-20867 for host-to-guest command execution on ESXi. The new phase moves down the stack to network gear that most teams treat as plumbing.
What did Fire Ant do differently in 2026?
The shift is structural. In 2025, Fire Ant focused on VMware ESXi and vCenter environments, extracting the vpxuser service account credentials to control connected ESXi hosts, deploying persistent backdoors, and using hypervisor-level access to interact directly with guest VMs. The actor killed the vmsyslogd process on ESXi hosts to cut off both local and remote log forwarding, blinding audit trails at the source. Sygnia's deep-dive analysis of that phase documents a patient adversary that adapted in real time to eradication efforts, replacing toolsets and maintaining access through multiple independent channels.
In 2026, Fire Ant moved to what Sygnia calls the "target behind the target": infrastructure that other systems depend on to communicate and be administered. The actor compromised Cisco IOS XR routers and turned them into operational platforms for three purposes: suppressing evidence, collecting traffic and credentials, and exploring access points to spread to connected organizations.
The campaign also hit TACACS infrastructure, the authentication protocol used to manage administrative access to network devices. By compromising TACACS servers, Fire Ant intercepted administrative authentication flows, collected credentials, and weakened confidence in administrative audit trails. If your network team relies on TACACS logs to verify who ran what on which router, those logs are now suspect.
How does the router-to-TACACS attack chain work?
Sygnia identified two novel tools in the 2026 phase that deserve attention from every network defender.
The first is BridgeAgent, a masquerading implant configured for tunneling and persistence. It disguises itself as a zabbix_agent.service systemd unit on Linux management hosts, set to run as root with automatic restart behavior. The implant uses a GRE tunnel to pivot from a legacy Linux server to an edge router, opening a route into connected environments. If you run Zabbix for monitoring, and most enterprises do, a rogue zabbix_agent.service is nearly invisible in a process list.
The second is TacTap, a TACACS credential-collection toolset. TacTap enables library injection, accepted-session interception, and Unix-socket file-descriptor handoff. In practice, this means Fire Ant can intercept authentication sessions in flight, capture credentials as they pass through TACACS infrastructure, and maintain access without needing to crack passwords or exploit additional vulnerabilities.
The chart above shows the distribution of techniques and tools Sygnia identified across each infrastructure layer. Linux management hosts carried the heaviest payload at 9 distinct techniques, including BridgeAgent, Medusa-related components, custom SSH backdoors, Zabbix-masquerading malware, packet-triggered backdoors, SELinux disablement, log tampering, firewall rule modification, and execution from deleted file paths. VMware ESXi and vCenter accounted for 6 techniques, TACACS servers for 4, and Cisco IOS XR routers for 3.
Fire Ant also established resilient persistence across Linux management infrastructure. The tool inventory includes Medusa-related components, custom SSH backdoors, Zabbix-masquerading malware, and packet-triggered backdoors. On Linux systems, the actor deleted files after execution, left processes running from deleted paths, disabled SELinux, tampered with logs, and modified firewall rules.
The defense evasion extended to network devices. Fire Ant hid logs, concealed commit activity, suppressed AAA requests, filtered SNMP traps, and manipulated command output on compromised routers. If you ran a show running-config on a compromised device, the output might not reflect what the actor actually changed.
What does this mean for your network operations?
This campaign changes the threat model for infrastructure that most teams monitor lightly. Routers, authentication servers, and management hosts are the trust layer of the entire network.
Three consequences hit production environments directly:
- Credential exposure is recursive. If Fire Ant compromised your TACACS server, every admin who authenticated through it during the exposure window has burned credentials. Rotating the TACACS shared key is not enough. You need to rotate every admin credential that passed through that server, because TacTap intercepted them in flight.
- Log integrity is broken. The actor suppressed AAA requests, SNMP traps, and syslog forwarding on compromised devices. If your SIEM shows clean activity on a router that was actually compromised, your audit trail has a gap. Retrospective investigation needs to account for deliberate log manipulation, not just missing data.
- Network segmentation is not a boundary. Fire Ant consistently bypassed segmentation by compromising network appliances and tunneling across segments through legitimate approved paths. If you assumed that VLAN separation or firewall rules between your management network and production would stop an attacker who controls the router, that assumption is wrong.
The connected-environment angle is the most dangerous part. Sygnia's director of incident response, Asaf Perlman, said the significance extended beyond the initially compromised environment because the affected infrastructure could provide a path toward other connected high-value environments. Your router is a bridge to every network it touches, and Fire Ant knows it.
For teams tracking the edge gear vulnerability picture, this campaign reinforces what CISA's known exploited vulnerabilities catalog has been signaling: network infrastructure is a live target, and the devices you patch last are the ones attackers want most. Our coverage of edge gear on the CISA KEV watchlist tracks the same pattern from the patch-management side.
What should network teams check right now?
Start with the three layers Fire Ant targets and work outward.
On Cisco IOS XR routers:
- Compare running configurations against known-good baselines, not against the device's own stored config. The actor hid commit activity, so the config you see may not be the config that is running.
- Check for unexpected GRE tunnels or interface configurations that enable covert connectivity between segments.
- Verify that AAA logging is actually forwarding to your SIEM. Do not assume silence means nothing happened.
- Look for modified command output. If
showcommands return unexpected results or missing sections, treat the device as suspect.
On TACACS servers:
- Hunt for injected libraries or unexpected shared objects loaded into the TACACS daemon process. TacTap uses library injection to intercept sessions.
- Check for processes holding unexpected Unix socket file descriptors. TacTap uses Unix-socket handoff to pass intercepted sessions to its collection component.
- Review authentication logs for anomalies during the period the server may have been compromised. Every admin credential that passed through is potentially burned.
On Linux management hosts:
- Look for
zabbix_agent.serviceunits running from unexpected paths or with configurations that do not match your deployment. BridgeAgent masquerades as this exact service and runs as root. - Check for processes running from deleted file paths. Fire Ant deletes binaries after execution and leaves processes running in memory.
- Verify SELinux status. If SELinux is disabled on a host where it should be enabled, investigate immediately.
- Review firewall rule changes. The actor modified firewall rules to maintain access paths.
- Hunt for Medusa-related components, custom SSH backdoors, and packet-triggered backdoors. These are long-lived implants designed to survive eradication efforts.
If you operate VMware infrastructure that Fire Ant may have targeted in the 2025 phase, the earlier investigation still applies. Check for terminated vmsyslogd processes on ESXi hosts, unexpected backdoors surviving reboots, and credential extraction from VM memory snapshots. The FortiBleed credential exposure playbook covers a parallel pattern for network appliance credential theft that pairs well with this response.
What is the broader read on Fire Ant?
Sygnia identified technical overlap between Fire Ant and UNC3886, a group previously attributed to campaigns targeting virtualization infrastructure. The shared binaries, exploitation of vCenter and ESXi vulnerabilities, and targeted verticals suggest either a common toolkit, a shared developer, or operational continuity under a new designation.
The 2026 expansion tells you what the group values. Fire Ant moved from hypervisors to routers because routers, TACACS servers, and management hosts are the connective tissue between segmented environments. Controlling them gives the actor reach, visibility, and persistence that survives individual host remediation.
The operational discipline is notable. Sygnia's initial announcement described a group that adapted in real time to eradication and containment actions, replacing toolsets and maintaining access through multiple independent channels. This is a patient adversary that treats your infrastructure as a long-term investment.
For defenders, the lesson is that infrastructure monitoring needs to extend below the operating system. Traditional endpoint security tools do not see into hypervisor layers, router firmware, or TACACS daemon processes. If your detection strategy stops at servers and workstations, you are blind to the layer where Fire Ant operates.
The trust layer is the new perimeter
Fire Ant compromised the trust layer itself. Routers authenticate admin access. TACACS validates who can configure what. Management hosts run the tools that control everything else. When an attacker owns that layer, segmentation, audit trails, and access controls all become variables the attacker controls.
The infrastructure you treat as background is the infrastructure attackers want most. Check it.
Sources
- Sygnia - Fire Ant: Hypervisor-Level Espionage Targeting VMware ESXi and vCenter
- Sygnia - Sygnia Uncovers Chinese Nexus Threat Actor Targeting Critical Infrastructure
- thehackernews.com - China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
- darkreading.com - Fire Ant Cyber Spies Compromise Siloed VMware Systems
- lifestyle.thepointnews.com - Sygnia Reveals New Activity by China-Nexus Threat Actor Fire Ant Targeting Trusted Infrastructure
