An unexplained GRE tunnel was operating on a Cisco IOS XR router even though its running configuration and commit history contained no record of it. That mismatch opened an investigation into Fire Ant, a China-nexus espionage cluster that had turned routers, TACACS authentication servers, and Linux management hosts into a hidden collection and access layer.
Incident-response firm Sygnia reported on August 27 that the actor remained active into 2026 after its earlier VMware-focused campaign. The recovered toolset suppressed router logs, concealed command output, captured administrative credentials, collected packet traffic, and kept multiple backdoors alive across trusted infrastructure. Sygnia wrote that the router’s operational state “could no longer be trusted to match the configuration and audit records.”
A tunnel exposed the compromise
The investigation began with the GRE interface. It was associated with a specific virtual routing and forwarding instance, yet administrators could not reconcile the live tunnel with the router’s visible configuration. That was a meaningful forensic conflict: the device could carry traffic through a path that its normal management views did not explain.
Tracing the tunnel led Sygnia to a legacy Linux host. From there, Fire Ant probed administrative and service ports on connected networks, including SSH, HTTP, SMB, and RDP. The actor also used compromised Cisco devices to capture network traffic and send packet captures to external FTP servers.
The reach extended toward high-value environments, including critical infrastructure. Sygnia observed scanning and connection attempts across those paths. It did not establish that the connected critical-infrastructure targets were compromised, so the demonstrated harm remains inside the investigated environment.
Sygnia did not disclose how Fire Ant first gained router access. It also did not quantify affected organizations, routers, TACACS servers, or Linux hosts. The report describes a bounded incident-response investigation, and it includes no public Cisco or affected-organization response or fixed software release.
Routers hid the actor
Fire Ant’s IOS XR tooling worked inside the router control plane. A persistence script at /etc/rc.d/init.d/grub-rommon launched /usr/bin/acpid during odd-numbered hours and stopped it during even-numbered hours, reducing continuous process visibility. The acpid implant, SHA-1 be6b27f429324a4af05a310d8ec9635e37c68a94, embedded a modified syslog library that forwarded a message only when it contained the string Health.
Another component at /pkg/bin/hd, SHA-1 b149fa3a34bd585e7a674a4fd9538437bd06f514, altered the router’s command path. It appended an IOS-style | exclude filter before forwarding show commands, hiding tunnel-related configuration from routine inspection. Device history contained repeated filters matching the tunnel interface, VRF, source, and destination.
The outbound component /pkg/bin/dhcpd_show_issu_status, SHA-1 1682b652a15bde732489f22809b0b7594c228fd3, used a hardcoded external address and IOS XR routing, VRF, RIB, and Telnet-management libraries. That design let the implant communicate from the router’s native networking context.
Figure details
Three evidence planes converge on a hidden access and collection layer. The IOS XR branch shows an unexplained GRE tunnel, selective syslog forwarding, filtered show output, and outbound connectivity. The TACACS branch shows library injection into tac_plus and captured credentials written to a hidden log file. The Linux branch shows monitoring-service impersonation, VMCI and packet-triggered backdoors, rootkits, and altered host records. Independent memory, disk, network, authentication, and configuration evidence is required to test each branch.
TACACS became a credential trap
Fire Ant moved from network control into the administrative authentication path. Sygnia named the recovered toolset TacTap. An injector at /usr/sbin/acppid, SHA-1 36005f5e4398a1c62a2a9271eddfcc1b44b1ad00, loaded /lib/libseconfd.so, SHA-1 955cd45a2f6f226a2fdf44b329af1c8dde90cb38, into the running tac_plus process.
The injected library hooked the functions that accepted connections and passed live session handles through a local Unix socket to another process. Captured credentials were written to /var/log/.tacplus.acct and obfuscated with the one-byte XOR key 0xEF. Sygnia said this specific tac_plus injection technique had not previously been described publicly to its knowledge.
That placement weakens two forms of trust at once. The authentication server can expose administrator credentials, while the compromised router and host layers can suppress or rewrite the records needed to reconstruct their use. Investigation therefore has to correlate TACACS process memory and library maps with connection records, router AAA events, administrative session timing, and downstream device changes.
Sygnia assessed strong overlap between Fire Ant and the China-nexus actor UNC3886. The firm stopped short of conclusive attribution. Fire Ant remains the activity label supported by this investigation.
Linux implants preserved access
The connected Linux systems carried several independent access paths. BridgeAgent persisted through zabbix_agent.service, masqueraded as a Zabbix monitoring agent, stored encrypted configuration at /opt/.ICEauthority, and polled over TLS on port 443. Fire Ant also deployed Medusa and REPTILE rootkit components, custom SSH backdoors, and binaries renamed and timestamped to resemble SentinelOne and Cybereason agents.
Sygnia found a VMCI backdoor at /var/tmp/audit, SHA-1 13f0c2a598e3aa63856c032a96b110aed963f0e8, that communicated over VMware Virtual Machine Communication Interface sockets. A separate packet-triggered backdoor at /var/tmp/ping, SHA-1 5ba1242050b5b447052b210788a5a25593d6987d, listened for a specific network pattern.
The trigger covered TCP ports 443, 541, 8443, and 10443, plus UDP source port 40443 to destination port 500, and used the string sxcdewqaz!@#. Treat that string as a packet and memory search value. The affected environment also contained implants that remained resident after their files were deleted.
Fire Ant worked on the evidence around those implants. The actor disabled SELinux, rewrote login history, removed privileged-command entries from system logs, suppressed router logs and SNMP traps, and interfered with authentication records. A clean file scan or an apparently normal show command cannot clear a system whose reporting path was itself under attacker control.
Verify every evidence plane
Start with infrastructure inventory. Identify every IOS XR router, TACACS server, VMware management system, Linux jump host, and monitoring server that shared routes or administrative trust with the affected segment. Preserve volatile memory and live network state before rebooting equipment or restarting authentication processes.
On IOS XR, compare operational interfaces and forwarding state with the committed configuration and external network telemetry. Search for unexplained GRE interfaces, | exclude filters attached to routine show commands, the Health-gated syslog behavior, /etc/rc.d/init.d/grub-rommon, /usr/bin/acpid, /pkg/bin/hd, and /pkg/bin/dhcpd_show_issu_status. Validate the router’s record against collector-side syslog, NetFlow, packet capture, AAA, and configuration-backup systems that the router could not rewrite.
On TACACS and Linux systems, inspect process library maps and memory alongside disk. Search for /usr/sbin/acppid, /lib/libseconfd.so, /var/log/.tacplus.acct, zabbix_agent.service, /opt/.ICEauthority, /var/tmp/audit, /var/tmp/ping, and sxcdewqaz!@#. Correlate those findings with outbound TLS, unexpected FTP transfer, VMCI activity, the published trigger ports, new systemd units, altered login history, disabled SELinux, and binaries impersonating security products.
The verification test is cross-plane agreement. Rebuild the expected topology and administrative timeline from independent router, TACACS, Linux, hypervisor, collector, and network records. The expected result for a trustworthy environment is that every live tunnel, privileged authentication, loaded library, persistent service, and outbound path has a documented configuration and matching records outside the device that produced it.
Fire Ant gained leverage from systems that usually certify what the rest of the network is doing. Recovery depends on restoring those systems as independent witnesses. Until their live state, configuration, and external telemetry agree, the network still lacks a defensible account of its own control plane.