China-Linked Fire Ant Group Compromises Cisco Routers to Steal Credentials and Blind Logs

Fire Ant Expands Attack Surface

The China-linked cyber espionage group, Fire Ant, has extended its campaign beyond VMware hypervisors to include Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts. These systems are critical for routing, authenticating, and managing high-value networks.

Router Compromise and Data Exfiltration

Incident response firm Sygnia reported that Fire Ant transformed the compromised routers into data collection platforms. This enabled the group to capture network traffic, harvest credentials, and disable logging and telemetry, which are essential for defenders to reconstruct attack sequences. Controlling the routers provided the actor with a strategic vantage point over trusted network traffic.

Targeting Critical Infrastructure

Sygnia assessed that the hacker group utilized its access to explore pathways into connected high-value environments, including critical infrastructure. While scanning and connection attempts were observed against these networks, confirmed compromises were limited. The router malware was specifically designed for the IOS XR control plane.

Attribution and Previous Activity

The observed activity shows strong overlap with public reporting on UNC3886, another China-nexus espionage group known for targeting virtualization platforms and network edge devices. Sygnia's investigation began with an anomaly on a Cisco IOS XR router, where an unexplained Generic Routing Encapsulation (GRE) tunnel interface was found. This follows Sygnia's July 2025 disclosure of Fire Ant's exploitation of VMware ESXi and vCenter environments.