The researchers discovered Fire Ant’s new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history.
According to incident response company Sygnia, the threat actor switched from targeting VMware hypervisors to compromising Cisco routers, TACACS authentication servers, and Linux management hosts.
The researchers discovered Fire Ant’s new tactic after finding on a Cisco IOS XR router an active GRE (Generic Routing Encapsulation) tunnel interface that could not be explained by a running configuration or commit history.
Further analysis revealed that Fire Ant had deployed custom malware on the devices, enabling persistence through a fake system service that ran the implant only during alternating hours.
The malware selectively suppressed syslog messages to hide tunnel-related information from legitimate administrators, established outbound Telnet connections to Fire Ant infrastructure, and supported interactive shell access with no logging.
The attackers also used their administrative access to capture traffic from multiple routers and upload the resulting PCAP files to external FTP servers.
These captures could expose internal topology, administrative connections, authentication flows, routing relationships, and traffic exchanged with connected networks.
“This behavior shifts the router’s role from a transit device to a collection platform,” Sygnia explains.
“Once the actor controlled the router, the device became a vantage point for observing traffic moving through trusted network paths.”
The concealed GRE tunnel connected one compromised router to a legacy Linux server, which Fire Ant used as a staging and reconnaissance system.
From there, the attackers probed systems in connected high-value environments, including systems associated with critical infrastructure, over ports commonly used for SSH, web services, SMB/RPC, and RDP.
Sygnia believes that Fire Ant’s operation aimed to compromise trusted infrastructure at an initial victim and use it as a covert bridge to explore access paths into connected high-value networks, a tactic which they dub “target behind the target.”
The researchers also discovered a previously undocumented backdoor called ‘BridgeAgent,’ which Fire Ant disguised as a legitimate Zabbix monitoring agent.
The backdoor persists as a root-level systemd service and supports TLS reverse shells and the execution of additional payloads on the compromised host.
Sygnia says Fire Ant activity strongly overlaps with UNC3886, a Chinese espionage group previously documented by Google. However, the researchers say that there are differences in filenames, paths, and implementation details.
The researchers warned that Fire Ant systematically tampers with system logs and records, even changing file timestamps to obscure evidence that would benefit investigators, noting that logs retrieved from compromised infrastructure should be validated against other data.
Sygnia’s report shares an extensive list of indicators of compromise (IoCs), along with hunting and YARA rules to detect Fire Ant activity.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
New Dysphoria DDoS botnet spreads to 200k devices worldwide
Unpatched Calix flaw lets hackers bypass NAT to expose internal devices
FBI disrupts proxy network enabling Chinese espionage operations
US and allies warn of Russian critical infrastructure attacks
Hackers exploit Roundcube flaw to spy on academic researchers
Microsoft Exchange Online outage causes email failures, auth issues
Anthropic is cutting Claude Code’s current weekly limits by 17%
Anthropic warns infostealer malware is hijacking Claude sessions to drain usage
Learn how ESET MDR can enhance your organization’s security posture
Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how.
Overdue a password health-check? Audit your Active Directory for free
Identity, Data Governance & Threat Detection in One Platform: Take our In-Browser Tour
AI-driven vulnerability discovery is accelerating. See how Action1 helps remediation keep pace.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
