China-Linked 'Fire Ant' Crew Breaks Into Cisco Routers to Steal Passwords and Hide Its Tracks
Sygnia says the espionage group has jumped from VMware servers to core network gear, tampering with logs and siphoning credentials from TACACS authentication servers.
Key points
- Sygnia has linked a China-aligned espionage group it calls Fire Ant to a fresh campaign targeting Cisco IOS XR routers, TACACS authentication servers and Linux management hosts.
- The hackers previously focused on VMware hypervisors, the software that runs multiple virtual servers on one physical machine, and have now moved deeper into network plumbing.
- Fire Ant is stealing login credentials and disabling security logs so defenders can't see what happened.
- Targets are high-value corporate and government networks, not home users.
- Defenders should check router configurations, audit TACACS accounts and verify whether logging has been silently disabled.
A China-linked spying group is quietly rewiring large organisations' internal networks, and this time it's going after the routers themselves.
Incident response firm Sygnia says the group, which it tracks as Fire Ant, has widened a long-running campaign. They're now operating inside Cisco IOS XR routers (heavy-duty machines that shuttle traffic across big corporate and carrier networks), TACACS servers (which check whether an engineer is allowed to log in to network gear), and the Linux computers administrators use to manage all of it. The findings were first reported by The Hacker News.
Fire Ant was already known for breaking into VMware hypervisors. Moving to routers and authentication servers is a serious escalation: own the router and the login server and you can read traffic, forge sessions quietly, and grant yourself access wherever you like.
Who is Fire Ant and what are they after?
Sygnia describes Fire Ant as a China-nexus cyber espionage actor, meaning a state-aligned group focused on stealing information rather than money. Targets are high-value networks: large enterprises, telecoms and government-adjacent operators.
The goal is persistence and stealth. Long-term access to the plumbing that carries and authenticates traffic, with defenders unable to see them there.
How did the hackers get in?
Sygnia's investigation found Fire Ant chaining access across three layers of infrastructure. They pivot from previously compromised VMware environments onto Linux hosts that manage network devices, then reach across to Cisco IOS XR routers and the TACACS servers that guard them.
Once on a router, the group harvests credentials passing through TACACS, giving them working logins for other devices without hacking each one individually. It's the network equivalent of stealing the master keyring from the building manager.
They also tamper with logging. Sygnia found evidence that security logs were disabled or rerouted so the hackers' commands never showed up in records defenders rely on. Can't chase out an intruder you can't see.
What is affected?
| Layer | Product or system | What the hackers do here |
|---|---|---|
| Virtualisation | VMware hypervisors | Initial foothold, pivot point |
| Network routing | Cisco IOS XR routers | Traffic interception, log tampering |
| Authentication | TACACS servers | Credential theft |
| Management | Linux admin hosts | Lateral movement and tooling |
Sygnia hasn't tied the campaign to a specific unpatched flaw with a CVE identifier in its public write-up. The intrusions look operator-driven: stolen credentials and hands-on-keyboard techniques rather than a single push-button exploit. That's consistent with what we reported on 17 August when Mustang Panda paired a backdoor with a kernel-level cloaking tool to stay hidden on compromised hosts. Different group, same discipline.
Should ordinary people be worried?
Not directly. This is an espionage campaign against big organisations, not a scam aimed at consumers. No consumer product needs patching and no customer data leak has been announced.
The indirect impact: if your employer, bank or telecom runs the affected gear, their security teams are checking router configurations and log pipelines this week. That's a good thing.
What should defenders do now?
Security teams running Cisco IOS XR should audit device configurations for unauthorised changes, verify that logging is intact and actually reaching the SIEM (the central system that collects security alerts), and rotate credentials stored on or used by TACACS servers. Sygnia also recommends treating VMware management networks and network-device management networks as equally sensitive, because Fire Ant clearly moves between them.
For the duration of any review, treat every credential that touched a compromised TACACS server as burned.
