Overview
- Sygnia, which published its report on Aug. 31, 2026, found the China‑nexus cluster Fire Ant expanded from VMware hypervisors to compromise Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts.
- Investigators traced an unexplained GRE tunnel on an IOS XR router to a legacy Linux host and found purpose‑built IOS XR implants, a TACACS library injector called TacTap, and a Zabbix‑masquerading backdoor named BridgeAgent.
- The attackers captured PCAP traffic on routers, intercepted live TACACS authentication sessions to harvest credentials, and exfiltrated the data to external servers while selectively suppressing or rewriting logs to hide their activity.
- Sygnia published IoCs and YARA rules and advised treating routers, TACACS servers, hypervisors, and jump hosts as first‑class forensic assets while validating logs against memory, disk, and network telemetry.
- The firm noted strong technical overlap with prior UNC3886 reporting but stopped short of firm attribution, and it reported only scanning and connection attempts toward connected critical networks rather than confirmed downstream compromises.