China-nexus cyber espionage actor tracked by Sygnia, known for compromising VMware ESXi/vCenter systems, routers, TACACS+ servers and Linux hosts.
Elttam says two packets and an offline crack of weak encryption let attackers run code on TACACS+ servers before login. Only the Shrubbery Networks build has a patch, leaving sites on the archived Facebook fork to migrate or limit who can reach port 49.
Reality
Elttam says a TACACS+ server flaw lets attackers run code before login with two packets and an offline crack of the protocol's weak encryption. Of the two main server codebases, Shrubbery Networks' has a fix that still has no CVE and Facebook's archived fork will get none, so the first job is finding out which daemon answers on port 49.
Reality
Sygnia found the China-nexus group running packet captures, a tac_plus credential hook and two layers of log suppression on the gear that authenticates the rest of the estate, and it never established how the router was breached.
Perspective Coverage
6 publishersReality
On a September 10 podcast, Eclypsium researchers walked from vulnerable signed UEFI shells to Fire Ant binaries wearing EDR agent names. The common thread is verification: a defender can check very little of that stack alone.
Reality
Sygnia says the actor pivoted from vCenter into ESXi on stolen vpxuser credentials, left backdoors that survive reboots, and terminated vmsyslogd so the hosts stopped writing an audit trail while containment ran.
Reality
Fire Ant treated routers, TACACS servers and Linux management hosts as the place to live rather than the place to pass through. The reported indicator list shows why that choice pays: the layer has almost no telemetry of its own.
Reality