Hackers Compromise Cisco Routers to Spy on Networks and Reach Critical Infrastructure | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

Fire Ant has moved beyond attacking individual systems and is now compromising network infrastructure that organizations trust to move traffic and manage access.

The actor has turned Cisco IOS XR routers into platforms for surveillance, remote connectivity, and movement toward high-value environments.

The campaign shows how an intruder can use a router as more than a gateway. Fire Ant created a GRE tunnel absent from running configuration and commit records, captured network traffic, and sent PCAP files to external FTP services.

Sygnia said in a report shared with Cyber Security News (CSN) that it also interfered with logs and command output, leaving administrators with an incomplete view of activity.

Analysts at Sygnia identified the activity while examining an intrusion that stretched across routers, Linux management hosts, and TACACS authentication servers.

Fire Ant was first reported in 2025 and remained active into 2026, expanding its focus from hypervisors into systems that route, authenticate, and monitor enterprise operations.

The risk reaches beyond the breached organization. From a Linux system at the far end of the tunnel, operators probed systems associated with critical infrastructure, using the compromised network as a bridge.

This echoes the threat posed by router malware deployment campaigns, where control of an appliance can expose data and open a route deeper into an environment.

Hackers Compromise Cisco Routers

Fire Ant’s router toolkit was built for the IOS XR control plane. A persistence script at /etc/rc.d/init.d/grub-rommon launched an implant disguised as /usr/bin/acpid on alternating hours, reducing visibility.

The implant modified the router’s syslog flow, selectively preventing messages from being delivered, while another component used IOS XR routing and Telnet-management functions for outbound communication.

A separate component altered command execution so show commands could add exclusion filters, hiding tunnel-related details.

That combination made the routers useful for concealment and collection. Fire Ant captured packets from several router interfaces and uploaded the data to external FTP infrastructure.

Packet captures can reveal network layouts, connections, authentication exchanges, and relationships between systems that defenders might otherwise treat as separate.

The report also described a Linux host running BridgeAgent, a backdoor masquerading as a monitoring process. It stored encrypted settings in /opt/.ICEauthority and contacted external infrastructure over TLS. The host became a staging point for scanning and access through the GRE tunnel.

Authentication and Evidence Under Attack

Fire Ant also targeted TACACS, a service that authenticates and records network-device administration. Its TacTap toolset injected a malicious library into the tac_plus process, intercepted accepted sessions, and wrote collected credential material to an obfuscated log artifact.

That undermines the records used to investigate their use. On Linux management servers, the actor added custom SSH backdoors and Medusa-related components, used names resembling normal services, and disabled or weakened SELinux.

A packet-triggered backdoor could wait for specially marked network traffic before activating, while port redirection and IP forwarding supported covert tunnelling.

Similar China-nexus router activity has demonstrated why network-device telemetry deserves the same scrutiny as endpoint evidence.

Responders should treat routers, authentication systems, hypervisors, jump hosts, and management appliances as core security and forensic assets.

Investigations should compare logs with memory, disk, network, authentication, and configuration evidence rather than trusting one data source.

Defenders should urgently investigate unapproved GRE interfaces, unexplained router PCAP creation, outbound FTP or SCP, gaps in command accounting, suspicious tac_plus injection, and deleted processes that remain active.

Reviewing external exposure and segmentation is equally important for organizations connected to operational networks.

Recent critical infrastructure red-team findings underline how weak identity and network controls can turn an initial foothold into wider access.

Organizations should rotate potentially exposed administrative credentials across all tiers, restore and verify security controls, collect volatile evidence before cleanup, and conduct broad hunts for the indicators below across routers and Linux systems.

Removing a single file is unlikely to be enough because Fire Ant used overlapping persistence and access paths that require a complete coordinated response across every affected technology layer.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC