Fire Ant attackers break into critical networks
A suspected China-linked spying group called Fire Ant is breaking into network routers and authentication servers instead of regular computers. Once inside, it hides in the network's own trusted equipment to steal login data and quietly watch traffic long term.
- Report priority
- Medium
- Targets
- Cisco IOS XR routers+1 more
How it works
Fire Ant compromises edge routers and Linux management servers, then plants hidden programs that pose as normal system software while altering logs and command output to hide the intrusion.
What to do
Instead, network teams should check edge routers and jump hosts for tampered logs, unexplained GRE tunnels, and listeners on TCP ports 443, 541, 8443, or 10443, or UDP traffic from source port 40443.
Review Sygnia's incident response report for its full indicator list and treat routers and management hosts as forensic evidence, not just trusted infrastructure, when investigating a possible compromise.
Technical details
Affected software: Cisco IOS XR routers, Linux jump hosts
Fire Ant breaks into an organization's Cisco IOS XR edge router and turns it into a covert relay point. It installs BridgeAgent, malware disguised as Zabbix monitoring software, which checks in with the attacker's servers over hidden network tunnels. On a connected Linux server, the group plants a malicious component inside the login system that captures usernames and passwords as staff and administrators authenticate, then encodes the stolen data before sending it out. The intruders edit router logs and command output so the changes stay hidden from network staff.
Fire Ant, assessed to overlap with the China-nexus group UNC3886, compromised Cisco IOS XR routers as operational platforms rather than just entry points. It deployed BridgeAgent, malware that masquerades as Zabbix monitoring and polls attacker-controlled servers, alongside GRE tunnels for covert connectivity. A separate toolset, TacTap, embeds a malicious shared object inside the TACACS authentication daemon to intercept accepted login sessions and exfiltrate credentials XOR-encoded.
A raw packet-triggered backdoor listens passively on specific TCP and UDP ports for a magic-string wake signal. The group also set HISTFILE to null to suppress bash command history on compromised Linux hosts.