GoKawiilFire Ant hackers convert Cisco IOS XR routers into covert data-collection tools
Incident responders at Sygnia say the China-linked group Fire Ant has expanded from compromising VMware hypervisors to hijacking Cisco routers, TACACS authentication servers, and Linux management hosts. Investigators found a hidden GRE tunnel on a Cisco IOS XR router that didn't match its configuration history, leading to discovery of custom malware that hides its activity from administrators and runs only during set hours. The attackers used their router access to capture network traffic and exfiltrate it to external FTP servers, then pivoted through a hidden tunnel into a Linux server to probe further into connected high-value networks, including ones tied to critical infrastructure.