Incident response company Sygnia has disclosed a new technique used by the Fire Ant espionage group: compromising Cisco IOS XR routers and transforming them from data-forwarding devices into monitoring and collection points inside the network. The investigation began after an active GRE tunnel interface was found on a Cisco router, without any explanation in the operating configuration or the approved change log.
According to Sygnia, the group expanded its targeting from VMware hypervisors to Cisco routers, TACACS authentication servers, and Linux servers used for management. After obtaining administrative privileges, the attackers planted custom malware that ensured persistence through a fake system service, designed to run the implant during alternating hours, reducing the chances of detection during routine scans.
The Network Router as a Collection Platform
The malware enabled the attackers to hide syslog messages associated with the tunnels and establish outgoing Telnet connections to their infrastructure, in addition to interactive sessions for shell access without logging. Administrative privileges were also used to capture traffic from multiple routers and then upload PCAP files to external FTP servers.
These files could reveal the internal network architecture, management connections, authentication flows, relationships between routing paths, and data exchanged with connected networks. Thus, the impact of the compromise is not limited to a single device; a compromised router gives attackers a position from which to monitor trusted paths carrying multiple connections.
A Bridge to High-Value Environments
The hidden GRE tunnel connected one of the compromised routers to an old Linux server, which Fire Ant used as a staging and reconnaissance point. From this server, the attackers scanned systems in connected, high-value environments, including systems associated with critical infrastructure, through common ports for SSH, web, SMB/RPC, and RDP services.
Sygnia describes this technique as targeting the “victim behind the victim”: compromising trusted infrastructure belonging to the first victim and then using it as a bridge to explore access paths into other networks. Researchers also identified a previously undocumented backdoor called BridgeAgent, disguised as a legitimate Zabbix monitoring agent. The backdoor operates as a systemd service with root privileges and supports reverse shells over TLS and the execution of additional payloads.
What Matters to Defense Teams?
Sygnia says that Fire Ant’s activity significantly overlaps with the Chinese espionage group UNC3886 previously documented by Google, but points to differences in file names, paths, and implementation details. This overlap alone does not prove that the two campaigns are identical.
In practical terms, relying solely on router configurations or logs may not reveal the compromise; the attackers tampered with logs and file timestamps to conceal evidence. Sygnia therefore warns that logs extracted from compromised infrastructure must be verified by comparing them with other sources. Its report includes an extensive list of indicators of compromise, along with hunting and YARA rules for detecting Fire Ant activity.
The facts show that protecting network devices is not limited to preventing configuration changes, but also involves detecting unexpected services, hidden tunnels, outgoing connections, and traces of packet capture. However, the material does not provide details about a specific victim or the volume of data collected—questions that remain open for subsequent investigations.