As reported by The Hacker News, the China-linked espionage actor tracked as Fire Ant has expanded its operational scope from VMware hypervisors into Cisco IOS XR routers, TACACS servers, and Linux management hosts — turning core network infrastructure into credential collection platforms while actively suppressing the telemetry defenders need to detect the intrusion.

Threat Intelligence: Fire Ant developed IOS XR-specific components that modify system libraries to filter outgoing log messages — forwarding only those containing the string "Health" — and alter the command execution path to append | exclude filters to show commands, effectively hiding attacker-created GRE tunnel interfaces from routine inspection.

What makes this campaign particularly significant is not the initial access vector, which remains unidentified, but the deliberate engineering of the router implant itself. This is not a generic Linux payload repurposed for a network device. Fire Ant developed IOS XR-specific components that modify system libraries to filter outgoing log messages — forwarding only those containing the string "Health" — and alter the command execution path to append | exclude filters to show commands, effectively hiding attacker-created GRE tunnel interfaces from routine inspection.

Why This Matters Beyond the Immediate Victims

Sygnia's assessment that this activity overlaps with public reporting on UNC3886 places it within a broader pattern of China-nexus actors targeting network edge and virtualization infrastructure. The strategic implication is clear: when an adversary controls routing infrastructure, they do not merely gain network reach — they gain perspective. They can observe traffic flows across trusted paths, capture credentials transiting authentication systems, and selectively suppress the evidence of their own presence.

For organizations that have invested heavily in endpoint detection and response (EDR) and cloud workload protection, this campaign illustrates a persistent blind spot. Network infrastructure — routers, switches, authentication servers — frequently runs on legacy management planes with limited native telemetry, inconsistent logging, and minimal behavioral monitoring. That is precisely the gap Fire Ant exploited.

Key Technical Observations

  • Anomalous GRE tunnels with no commit history on IOS XR devices served as the initial indicator. This suggests the actor operated outside the device's normal configuration management workflow, which is itself a detection opportunity.
  • Log filtering via modified system libraries means traditional SIEM ingestion from these devices cannot be trusted as complete. Defenders must assume that absence of logs from a compromised device does not equate to absence of activity.
  • Command output manipulation via injected | exclude filters means that even interactive forensic inspection of a live compromised router may return sanitized results. This undermines confidence in on-device investigation and necessitates out-of-band network telemetry.
  • Lateral movement from legacy Linux management hosts — including SSH, HTTP, SMB, and RDP probing — reinforces that aging infrastructure management systems remain high-value pivot points.

Who Is at Risk

Organizations most exposed are those operating Cisco IOS XR-based routing infrastructure — common in service provider, data center, and critical infrastructure environments — particularly where TACACS is used for centralized authentication and legacy Linux hosts serve as management jump points. Environments that rely on on-device logging as their primary network telemetry source are at a severe disadvantage against this class of adversary.

Shield53 Recommendations

  • Implement out-of-band network telemetry. Use network taps, SPAN/mirror ports, or NetFlow/IPFIX collectors that are physically or logically separate from the devices they monitor. An attacker controlling a router cannot suppress telemetry they do not control.
  • Audit GRE tunnel configurations against commit history. Any tunnel interface that exists without a corresponding commit entry in the IOS XR configuration history should be treated as suspicious and investigated immediately.
  • Verify TACACS server integrity. If TACACS servers are compromised, all credentials authenticated through them should be considered exposed. Rotate administrative credentials and review authentication logs for anomalies predating the detected compromise window.
  • Isolate and harden management infrastructure. Legacy Linux management hosts should be segmented from production routing infrastructure, patched to current supported versions, and monitored with EDR. They should not serve as general-purpose jump hosts.
  • Validate on-device command output. During incident response on IOS XR devices, cross-reference show command output against out-of-band network observations. Do not trust on-device output as a sole source of truth when compromise is suspected.
  • Baseline and monitor configuration drift. Deploy configuration management tools that maintain an independent record of expected router configurations and alert on any deviation that lacks an authorized change record.
The most dangerous adversary is not the one who breaches your perimeter — it is the one who controls the infrastructure you trust to tell you whether a breach occurred. Fire Ant's campaign demonstrates that network infrastructure is not just a pathway for attacks; it is the attack surface where visibility itself can be weaponized against defenders.