Fire Ant Turns Cisco IOS XR Routers Into Credential Traps and Kills the Logs

A China-nexus espionage group tracked as Fire Ant spent at least a year inside a high-value network by owning the devices that carry and authorize traffic, not the endpoints. Incident response firm Sygnia found the actor operating on Cisco IOS XR routers, a TACACS+ authentication server, and Linux management hosts, using them to take packet captures, harvest credentials, and cut off the telemetry defenders would need to reconstruct any of it. Components planted in 2025 were still being used for hands-on activity in 2026, and at least one backdoor kept running in memory after its file had been deleted from disk.

This is the same cluster Sygnia disclosed in July 2025 for exploitation of VMware ESXi and vCenter. The 2026 activity is the same operators moving down the stack, out of the hypervisor and into the network and management layers, where logging is thin and forensic tooling is thinner.

The tell was a tunnel with no configuration

The investigation started with a GRE tunnel interface running on a Cisco IOS XR router that had no running configuration and no commit history to explain it. The interface existed. The record of how it got there did not. Sygnia never established how the actor first gained access to the router, which is worth sitting with: the initial access vector for the highest-privilege device in the path is still unknown.

Following that tunnel led to a legacy Linux system, from which Fire Ant ran repeated connection attempts and port probing against SSH, HTTP, SMB, and RDP on connected networks. Sygnia assessed the actor was mapping paths into adjacent high-value environments, including critical infrastructure, but found only scanning and connection attempts there, not confirmed compromise.

Router malware built for IOS XR, not for Linux

The implants were purpose-built for the IOS XR control plane rather than repurposed Linux appliance malware, which is what makes this interesting rather than routine. Two components stand out:

• A modified system library that inspected every outgoing log message for the string Health and forwarded the message only if that string was present. Everything else was silently dropped, so the router looked like it was still talking to the SIEM.
• A change to the command-execution path that appended an | exclude filter to show commands, so an administrator inspecting the device saw output with the attacker's tunnel configuration stripped out of it.

With that in place, Fire Ant used the routers to collect PCAPs from multiple Cisco devices and upload them to external FTP servers. One of those servers appeared to have been stood up the same day the uploads happened.

TacTap: a tac_plus injection technique not seen publicly before

On the TACACS server, Sygnia recovered a credential-collection toolset it named TacTap. An injector called acppid loaded a malicious library into the live tac_plus authentication process. The library hooked the functions that accept new connections and passed the live session handles to a second process over a local Unix socket. Captured credentials were written to /var/log/.tacplus.acct and obfuscated with a single-byte XOR key of 0xEF, which is obfuscation in name only and decodes in one line of Python.

Sygnia says this specific library-injection approach against tac_plus has not been publicly described before. TACACS+ credential theft itself is established tradecraft for this cluster: Mandiant previously documented UNC3886 deploying a TACACS+ sniffer called LOOKOVER and replacing the tac_plus daemon outright with a backdoored build. The difference matters operationally. A replaced binary shows up in file integrity monitoring and package verification. An injected library into a running process does not touch the daemon on disk at all.

A TACACS server is a credential firehose. Every device that authenticates against it hands over plaintext credentials in the normal course of operation. Owning it is equivalent to owning every router, switch, and firewall in the authentication domain.

BridgeAgent and a durable Linux layer

On the tunnel-connected host, Sygnia found a second new tool, a Linux backdoor called BridgeAgent that masqueraded as a Zabbix monitoring agent. It persisted through a zabbix_agent.service systemd unit running as root, disguised its process as /usr/bin/gnome-shell, kept encrypted configuration at /opt/.ICEauthority, and polled attacker infrastructure over TLS on port 443 for commands and reverse shells. Every one of those choices is blend-in tradecraft against an analyst scanning a process list.

Across the Linux management hosts the actor built redundancy: the open-source Medusa and REPTILE rootkits, custom SSH backdoors, and binaries renamed and timestamped to impersonate SentinelOne and Cybereason endpoint agents. Naming your implant after the EDR product is a bet that nobody questions a process that looks like the security tool.

Anti-forensics as a first-class objective

Fire Ant did not just hide, it attacked the evidence. Sygnia documented suppression of router logs, SNMP traps, and authentication requests, SELinux disabled on Linux hosts, login-history records rewritten, and entries for privileged commands removed from system logs. The practical consequence for responders is that a clean log is not evidence of a clean device.

Attribution and what to do

Sygnia says the activity strongly overlaps with public reporting on UNC3886, the China-nexus group known for hitting virtualization platforms and network edge devices, but stops short of conclusive attribution. Mandiant, which first documented UNC3886, has said it found no technical overlap with Salt Typhoon or Volt Typhoon. Treat this as a distinct cluster, not another Typhoon.

Concrete actions for network and IR teams:

• Audit IOS XR devices for tunnel interfaces that have no matching running configuration or commit history, and compare device state against out-of-band configuration backups.
• Hunt for the TacTap artifacts: /usr/sbin/acppid (SHA1 36005f5e4398a1c62a2a9271eddfcc1b44b1ad00), /lib/libseconfd.so (955cd45a2f6f226a2fdf44b329af1c8dde90cb38), and the credential file /var/log/.tacplus.acct, decoded with XOR 0xEF.
• Check for zabbix_agent.service units on hosts that do not run Zabbix, and for encrypted config at /opt/.ICEauthority.
• Check the IOS XR implant hashes: /usr/bin/acpid (be6b27f429324a4af05a310d8ec9635e37c68a94), /pkg/bin/dhcpd_show_issu_status (1682b652a15bde732489f22809b0b7594c228fd3), /pkg/bin/hd (b149fa3a34bd585e7a674a4fd9538437bd06f514), plus the persistence script under /etc/rc.d/init.d/.
• Alert on syslog volume dropping to near zero from a device that is still forwarding, which is the signature of the Health-string filter.
• Rotate every credential that has transited the TACACS server, and treat device-local fallback accounts as compromised too.

Sygnia's closing recommendation is the right one: routers, TACACS servers, hypervisors, and jump hosts are first-class forensic assets and should be imaged, memory-captured, and validated the same way a domain controller would be. Validate findings against memory, disk, network, authentication, and configuration evidence together rather than trusting a single telemetry source, because in this intrusion each individual source had been tampered with.