- The Mess: The China-nexus Fire Ant threat actor has moved beyond servers and hypervisors and is now compromising the infrastructure organizations trust to route traffic, authenticate administrators and record what those administrators do.
Sygnia’s latest investigation found Fire Ant targeting Cisco IOS XR routers, TACACS authentication servers and Linux management hosts during 2026 operations.
The routers weren’t just another machine to compromise.
They became surveillance platforms.
Fire Ant used compromised network infrastructure to collect traffic, establish covert connectivity and search for paths into other high-value environments.
That changes the defensive problem.
If an attacker owns a workstation, defenders can replace the workstation.
If an attacker owns the router carrying the traffic, the attacker can watch everyone else’s traffic.
- The Damage: Compromised routers can provide network visibility and access while compromised TACACS infrastructure can expose administrator credentials and corrupt the audit trail used to determine what happened.
The Router Was the Vantage Point
Sygnia discovered an active GRE tunnel on a Cisco IOS XR router that couldn’t be explained by the router’s configuration or commit history.
That was the first clue.
The tunnel provided Fire Ant with a path into the network.
The attackers then deployed custom tooling that turned the router into something much more useful than a simple foothold.
It could collect traffic.
It could communicate with attacker-controlled infrastructure.
It could provide visibility into connected systems.
And it could help Fire Ant understand how the environment was actually wired together.
The attacker wasn’t simply sitting inside the network.
The attacker could see the network.
The Malware Doesn’t Want to Run All the Time
One of Fire Ant’s router implants uses a particularly nasty persistence mechanism.
The malware masquerades as a legitimate system service and is configured to execute during alternating hours.
That makes the implant harder to spot during routine checks.
A defender inspecting the router at the wrong time may see nothing suspicious.
The configuration can look clean.
The commit history can look clean.
The malicious process simply isn’t there when someone looks.
This is persistence designed around the defender’s assumptions.
Then Fire Ant Went After TACACS
The next target was even more valuable.
TACACS+.
Organizations use TACACS+ to authenticate network administrators and control which commands those administrators can execute.
It also provides an audit trail.
Who logged in?
When?
From where?
What did they do?
That makes a TACACS server extremely attractive to an attacker.
Compromise the authentication layer and you don’t just get credentials.
You potentially get visibility into how administrators operate the network.
TacTap Attacks the Authentication Process
Sygnia discovered a custom Linux implant called TacTap.
Its interesting feature isn’t simply persistence.
TacTap injects malicious code into the running TACACS+ authentication daemon.
That means the attacker can interfere with authentication activity without replacing the legitimate executable on disk.
The binary can remain apparently intact.
File-integrity monitoring can therefore miss the compromise.
The malicious code lives inside the running process.
That is a very different problem from finding a suspicious executable in /tmp.
The Logs Can Lie
This is where the operation gets particularly ugly.
TACACS+ logs are supposed to provide an authoritative record of administrator activity.
TacTap can manipulate that telemetry.
An attacker can therefore compromise the system responsible for recording privileged activity and then interfere with the evidence describing the compromise.
That creates a nasty forensic problem.
The defender asks:
Who logged in?
The system answers.
But the system has already been compromised.
The answer may no longer be trustworthy.
Sygnia describes this as an attack on the trust layer surrounding network administration rather than simply another endpoint compromise.
Fire Ant Wants the Infrastructure Behind the Infrastructure
Fire Ant’s activity extends beyond routers and authentication servers.
Sygnia also observed compromises involving Linux management hosts.
Those machines can provide access to administrative tools and additional credentials.
Together, the compromised components form a chain:
Router → authentication → management host → connected environment
The initial device doesn’t necessarily contain the final target.
It provides perspective.
And perspective is incredibly valuable during espionage operations.
The Target Behind the Target
Sygnia says Fire Ant’s operations can involve third-party environments and trusted relationships between organizations.
That creates another uncomfortable possibility.
A compromised router or management system can become a stepping stone toward another organization that trusts the compromised environment.
The attacker doesn’t necessarily need to breach the second company directly.
They can abuse the relationship.
This is especially dangerous for telecommunications, managed services, infrastructure providers and organizations that maintain connections into multiple customer networks.
Why Network Devices Are So Attractive
Most security programs are heavily focused on endpoints.
EDR watches laptops.
Servers have agents.
Cloud workloads generate logs.
Email has filtering.
Network infrastructure often gets much less attention.
Routers aren’t supposed to run random malware.
Authentication appliances aren’t supposed to be treated like workstations.
That assumption is exactly what attackers can exploit.
A compromised laptop should generate noise.
A compromised router can quietly become the place where the noise is observed.
Fire Ant Also Cleans Up
Sygnia observed the attackers manipulating logs and deleting files to conceal activity.
That matters because network infrastructure often becomes part of the forensic evidence during an incident.
If attackers control that infrastructure, defenders can’t automatically assume its logs are authoritative.
The device may be compromised.
The telemetry may be manipulated.
The configuration history may not tell the entire story.
Incident response therefore has to include the devices that created the logs, not just the devices mentioned in them.
The Fix
Organizations should treat routers, TACACS servers and Linux management hosts as first-class security assets.
Restrict management access.
Use strong authentication.
Monitor configuration changes.
Monitor unusual GRE tunnels and unexpected routing behavior.
Collect logs externally where possible.
Protect TACACS infrastructure separately from ordinary management networks.
And when compromise is suspected, don’t trust the affected device to tell you whether it was compromised.
- The Fix: Monitor network devices as aggressively as servers, restrict management paths, collect authentication logs off-device, inspect unexplained tunnels and processes, and treat compromised routers or TACACS servers as untrusted forensic evidence.
For high-value environments, network telemetry should survive the compromise of the device generating it.
Otherwise the attacker gets something more useful than persistence.
They get plausible deniability.
Bugstoday Opinion
This is the kind of intrusion that makes traditional security architecture look slightly ridiculous.
We spent years putting EDR on everything.
Then attackers moved underneath it.
Fire Ant doesn’t need your laptop to be interesting.
It wants the router.
The authentication server.
The management host.
The machines that tell everyone else where to go and who is allowed in.
And TacTap is the part that should make network administrators uncomfortable.
If the authentication server is compromised, the logs themselves become suspect.
At that point the attacker isn’t just hiding from the defenders.
They’re helping write the story the defenders will investigate later.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Sygnia — Fire Ant Evolves: From Hypervisors to Trusted Infrastructure
Sygnia — Fire Ant Threat Research
The Record — Fire Ant Cisco Router Campaign
Cisco Talos — Related Cisco Infrastructure Threat Research
MITRE ATT&CK — Network Device Discovery / Network Device Tunneling
