A China-nexus cyber espionage actor tracked as Fireplace Ant has expanded a long-running marketing campaign past VMware hypervisors to compromise Cisco IOS XR routers, Terminal Entry Controller Entry-Management System (TACACS) servers, and Linux administration hosts used to route, authenticate, and handle high-value networks.
Sygnia, the incident response agency that investigated the intrusion, stated the actor turned the compromised routers into assortment platforms, capturing community visitors, harvesting credentials, and suppressing the logging and telemetry that defenders depend on to reconstruct an assault.
The agency assessed that the hacker group used its foothold to discover paths to linked high-value environments, together with important infrastructure. Nonetheless, exercise towards these networks was restricted to scanning and connection makes an attempt relatively than confirmed compromise.
Controlling the routers gave the actor a vantage level over visitors shifting by way of trusted community paths, Sygnia stated.
“This exercise reinforces one of many core observations from the investigation: when a menace actor controls routers, they don’t solely achieve attain. They achieve perspective,” the agency stated.
The agency assessed that the exercise strongly overlaps with public reporting on UNC3886, a China-nexus espionage group recognized for concentrating on virtualization platforms and community edge units, although it stated in its report that it doesn’t make a conclusive attribution.
Mandiant, which first documented UNC3886, has stated it discovered no technical overlap between the group and the separate Chinese language operations tracked as Salt Hurricane and Volt Hurricane.
The 2026 exercise follows Sygnia’s July 2025 disclosure of Fireplace Ant, which detailed the group’s exploitation of VMware ESXi and vCenter environments earlier than shifting into the community and administration layers.
The investigation started with an anomaly on a Cisco IOS XR router, the place a Generic Routing Encapsulation (GRE) tunnel interface was working with no operating configuration or commit historical past to elucidate the way it had been created. Sygnia didn’t establish how the actor first gained entry to the router.
Tracing the tunnel led investigators to a legacy Linux system, from which Fireplace Ant ran repeated connection makes an attempt and port probing towards administrative and repair ports on linked networks, together with SSH, HTTP, SMB, and RDP.
The router malware was purpose-built for the IOS XR management airplane relatively than a generic Linux equipment. One part embedded a modified system library that checked every outgoing log message for the string Well being and forwarded it solely when the string was current.
A separate part altered the router’s command-execution path to append an | exclude filter to present instructions, hiding the attacker’s tunnel configuration from directors inspecting the machine.
Fireplace Ant then used the routers to seize packet captures (PCAPs) from a number of Cisco units. The captures have been uploaded to exterior FTP servers, certainly one of which appeared to have been put in the identical day the uploads happened.
On the TACACS server, Sygnia recognized a credential-collection toolset it tracks as TacTap.
An injector named acppid loaded a malicious library into the operating tac_plus authentication course of. The library hooked the features that settle for new connections. It then handed the reside session handles to a second course of over an area Unix socket.
The captured credentials have been written to /var/log/.tacplus.acct and flippantly obfuscated with a single-byte XOR key of 0xEF.
“To our data, this particular tac_plus library-injection approach has not been publicly described earlier than, making it a notable evolution of Fireplace Ant’s TACACS-focused credential assortment tradecraft,” Sygnia stated.
Credential theft from TACACS servers is established tradecraft for the cluster, as Mandiant has beforehand documented UNC3886 deploying a TACACS+ sniffer known as LOOKOVER and changing the tac_plus daemon with a backdoored model to log credentials.
Sygnia additionally recovered a second new instrument, a Linux backdoor it known as BridgeAgent, which was deployed on the tunnel-connected host and masqueraded as a Zabbix monitoring agent.
The implant persevered by way of a zabbix_agent.service systemd unit operating as root, disguised its course of as /usr/bin/gnome-shell, and polled the attacker’s infrastructure over TLS on port 443 for instructions and reverse-shell directions.
Throughout the Linux administration hosts, Fireplace Ant constructed a sturdy entry layer utilizing the open-source Medusa and REPTILE rootkits, customized SSH backdoors, and binaries renamed and timestamped to impersonate the SentinelOne and Cybereason endpoint safety brokers.
A number of of those elements have been planted in 2025 and reused for hands-on exercise in 2026. At the least one backdoor stored operating in reminiscence after its file had been deleted from disk, Sygnia stated.
The actor additionally labored to undermine the proof itself by suppressing router logs, SNMP traps, and authentication requests; disabling SELinux on the Linux hosts; rewriting login-history data; and eradicating entries for privileged instructions from system logs.
Sygnia stated routers, TACACS servers, hypervisors, and soar hosts ought to be handled as first-class forensic belongings, and that investigators ought to validate logs towards reminiscence, disk, community, authentication, and configuration proof relatively than a single telemetry supply.
Sygnia revealed the next indicators of compromise (IoCs) –
- TacTap: the injector
/usr/sbin/acppid(SHA136005f5e4398a1c62a2a9271eddfcc1b44b1ad00), the injected library/lib/libseconfd.so(955cd45a2f6f226a2fdf44b329af1c8dde90cb38), and the credential file/var/log/.tacplus.acct, decoded with XOR key0xEF. - BridgeAgent: persistence by way of a
zabbix_agent.servicesystemd unit, encrypted configuration at/decide/.ICEauthority, and command-and-control (C2) over TLS on port 443. - IOS XR implants:
/usr/bin/acpid(be6b27f429324a4af05a310d8ec9635e37c68a94),/pkg/bin/dhcpd_show_issu_status(1682b652a15bde732489f22809b0b7594c228fd3),/pkg/bin/hd(b149fa3a34bd585e7a674a4fd9538437bd06f514), and the persistence script/and so forth/rc.d/init.d/grub-rommon. - VMCI backdoor:
/var/tmp/audit(13f0c2a598e3aa63856c032a96b110aed963f0e8), speaking over VMware Digital Machine Communication Interface (VMCI) sockets. - Packet-triggered backdoor:
/var/tmp/ping(5ba1242050b5b447052b210788a5a25593d6987d), activating on TCP ports 443, 541, 8443, and 10443 and UDP supply port 40443 to vacation spot port 500, triggered by the stringsxcdewqaz!@#.
The corporate’s full indicator set and YARA guidelines can be found in its report.
The exercise parallels the router and TACACS+ visitors assortment {that a} CISA-led joint advisory attributed to Salt Hurricane in August 2025, a separate Chinese language espionage cluster that captured packet information from compromised routers to reap administrator credentials throughout telecommunications networks.
