Fire Ant taught a Cisco IOS XR router to forward only log lines containing the word Health

Fire Ant, a China-nexus cyber espionage actor, expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts used to route, authenticate and manage high-value networks.

Sygnia assessed the group used its foothold to explore paths to connected high-value environments including critical infrastructure, but activity against those networks was limited to scanning and connection attempts rather than confirmed compromise.

Sygnia assessed the activity strongly overlaps with public reporting on UNC3886, a China-nexus espionage group known for targeting virtualization platforms and network edge devices, but said its report does not make a conclusive attribution.

Sygnia, the incident response firm that investigated the intrusion, said the actor turned compromised routers into collection platforms, capturing network traffic, harvesting credentials and suppressing logging and telemetry defenders rely on to reconstruct an attack.

Mandiant, which first documented UNC3886, has said it found no technical overlap between that group and the separate Chinese operations tracked as Salt Typhoon and Volt Typhoon.

The 2026 activity follows Sygnia's July 2025 disclosure of Fire Ant, which detailed the group's exploitation of VMware ESXi and vCenter environments before it moved into the network and management layers.

Fire Ant used the routers to capture PCAPs from multiple Cisco devices and uploaded them to external FTP servers, one of which appeared to have been installed the same day the uploads took place.

On the TACACS server, Sygnia identified a credential-collection toolset it tracks as TacTap; an injector named acppid loaded a malicious library into the running tac_plus authentication process, hooked the functions that accept new connections, and passed live session handles to a second process over a local Unix socket.

Captured credentials were written to /var/log/.tacplus.acct and lightly obfuscated with a single-byte XOR key of 0xEF.

Tracing the tunnel led investigators to a legacy Linux system, from which Fire Ant ran repeated connection attempts and port probing against administrative and service ports on connected networks, including SSH, HTTP, SMB and RDP.

Sygnia said that to its knowledge the specific tac_plus library-injection technique has not been publicly described before, making it a notable evolution of Fire Ant's TACACS-focused credential collection tradecraft.

Mandiant has previously documented UNC3886 deploying a TACACS+ sniffer called LOOKOVER and replacing the tac_plus daemon with a backdoored version to log credentials.

Sygnia recovered a second new tool, a Linux backdoor it called BridgeAgent, deployed on the tunnel-connected host and masquerading as a Zabbix monitoring agent; it persisted via a zabbix_agent.service systemd unit running as root, disguised its process as /usr/bin/gnome-shell, and polled attacker infrastructure over TLS on port 443 for commands and reverse-shell instructions.

Sygnia did not identify how the actor first gained access to the router.

Across the Linux management hosts, Fire Ant built a durable access layer using the open-source Medusa and REPTILE rootkits.

Because the GRE tunnel interface was running with no configuration and no commit history, a review of the device's change record would not have contained it, so detection required comparing observed interface state against the stored configuration.

A single-byte XOR key has 256 possible values, so the /var/log/.tacplus.acct credential file can be decoded by a responder at negligible cost once the file is found.

The reporting documents five distinct concealment mechanisms across the router, TACACS and Linux tiers: the Health-string syslog filter, the show-command exclude filter, BridgeAgent's Zabbix and gnome-shell masquerade, the Medusa and REPTILE rootkits, and the hidden XOR-obfuscated credential file.