GoKawiilFire Ant hackers convert Cisco IOS XR routers into covert data-collection tools
Incident responders at Sygnia say the China-linked group Fire Ant has expanded from compromising VMware hypervisors to hijacking Cisco routers, TACACS authentication servers, and Linux management hosts. Investigators found a hidden GRE tunnel on a Cisco IOS XR router that didn't match its configuration history, leading to discovery of custom malware that hides its activity from administrators and runs only during set hours. The attackers used their router access to capture network traffic and exfiltrate it to external FTP servers, then pivoted through a hidden tunnel into a Linux server to probe further into connected high-value networks, including ones tied to critical infrastructure.
GoKawiil's interpretation of the reporting above, not reported fact.
By turning trusted network routers into surveillance points, Fire Ant can quietly observe internal topology, authentication flows, and administrative traffic without triggering typical alerts, since the malware suppresses logs and blends into normal operations. This approach shows attackers increasingly targeting network infrastructure itself rather than just endpoints, making detection harder and giving them a durable foothold for espionage across interconnected systems, including sensitive infrastructure environments.
- Fire Ant shifted tactics from VMware hypervisors to Cisco routers, TACACS servers, and Linux hosts.
- Custom malware hid GRE tunnels, suppressed logs, and enabled undetected shell access on compromised routers.
- Captured router traffic was exfiltrated via FTP, exposing network topology and enabling deeper intrusion into critical systems.
Yubico YubiKey 5 NFC Security Key — When attackers go after TACACS servers and admin credentials like Fire Ant did, passwords alone are a weak link. The YubiKey 5 NFC adds hardware-backed multi-factor authentication for your network admin accounts, SSH keys and password manager, working over USB-A or NFC tap. It's a pocket-sized way to make stolen credentials far less useful.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-31
Published there as: “Chinese Fire Ant hackers turn Cisco routers into spying platforms”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.