Fire Ant turned Cisco IOS XR routers and TACACS servers into covert spying platforms

What the campaign did

A threat group tracked as Fire Ant gained highly privileged access to Cisco IOS XR routers, the TACACS+ servers that authenticate network administrators, and the Linux hosts used to manage them, then converted that infrastructure into covert surveillance and access tooling. The campaign was reported by BleepingComputer on August 31, 2026, drawing on incident-response work by the security firm Sygnia, which directly observed both credential theft and the exfiltration of captured network traffic. BleepingComputer's coverage characterizes the actors as Chinese.

How the attackers first got in has not been disclosed. What researchers mapped is everything that came after: a layered operation designed to stay resident for the long term while hiding from the very people responsible for the compromised systems.

Routers repurposed as surveillance sensors

According to the report, the operators installed IOS XR-specific implants and persistence scripts on the routers and manipulated syslog messages and CLI output so the devices would mislead their own administrators. They established GRE tunnels tied to VRFs and made outbound Telnet connections that rarely showed up in the running configuration or command history.

The routers themselves became packet sensors. Traffic was captured into PCAP files on the devices and shipped to attacker-controlled FTP servers, exposing internal network topology and authentication flows. At the Linux end of the tunnels, the group deployed BridgeAgent, rootkits — the Medusa rootkit is named among the toolkit — a custom SSH implementation, and backdoors that activate only in response to specially crafted packets.

On the identity side, a component called TacTap injected a library into tac_plus, the standard TACACS+ daemon, harvesting administrator credentials as they were validated. The actors then probed SSH, HTTP(S), SMB/RPC and RDP services reachable from the management plane to test paths toward high-value networks, including critical infrastructure. Sygnia observed these reachability checks, but per the report it could not confirm that every probed destination was subsequently breached.

Why it stayed invisible

The campaign's defining feature was that it lived inside the systems operators trust most. End users would see nothing; at worst, minor network or authentication anomalies. The intrusion surfaced when investigators found a VRF-enabled GRE tunnel active on a router that appeared in neither the running configuration nor the commit history — the device's live state disagreed with the official record of that state.

The report lists telltale signs for defenders: missing syslog, AAA and SNMP records; management commands executed with no matching login; show output contradicting independent flow data; PCAP and FTP traffic originating from routers; fake services; and artifacts such as /var/log/.tacplus.acct, remote.txt, /usr/bin/acpid, cupsdd, smartdd and /usr/lib/locate, along with deleted-but-running processes and tampering with SELinux and iptables rules. Stolen credentials obfuscated with a single-byte XOR of 0xEF, tac_plus injections and log manipulation via utmpdump and sed are called out for threat hunting, alongside Sygnia's published indicators and YARA rules.

Detection and recovery

Because the attackers could rewrite logs and device displays, the report's central recommendation is that no device's own output can serve as evidence: independent NetFlow, out-of-band configuration management, memory inspection and separate authentication logs are needed to reconstruct what actually happened. Recommended containment steps include isolating the management plane from business networks and external access, allowlisting outbound destinations, monitoring TACACS servers and Linux management hosts for file integrity violations and process injection, rebuilding compromised systems from known-good images, and rotating TACACS and SSH credentials, keys and trust relationships on the assumption they were stolen. Where cloud management infrastructure is connected, new sessions created with administrator credentials should be treated as potentially attacker-initiated.

Why it matters

This is more than router malware. Fire Ant weaponized the management plane itself — the layer that exists to give defenders visibility — and turned it into the instrument of espionage, credential theft and staged access. Any organization that relies on device-generated logs and TACACS authentication has effectively delegated its audit trail to infrastructure an attacker can silently control. The probes toward critical infrastructure networks leave open the possibility of follow-on compromise, and because the initial access vector remains unknown, patching alone will not close the door. The practical lessons are architectural: keep independent sources of truth, isolate the management plane, and assume that after this kind of intrusion, rebuilding from clean images is the only trustworthy path back.