Fire Ant moves from hypervisors onto Cisco routers

Sygnia published an incident-response report saying the actor it tracks as Fire Ant has pushed beyond hypervisors into the trusted network layer, compromising Cisco IOS XR routers, TACACS authentication servers and Linux management hosts inside an investigated environment. Sygnia assesses the activity "strongly overlaps" public Mandiant and Google Cloud reporting on the China-nexus cluster UNC3886, an overlap of tradecraft, not a confirmed identity, and this is one environment under investigation, not a proven global campaign.

The investigation began with a GRE tunnel interface running on a Cisco IOS XR router with no matching entry in the running configuration and no commit history to explain how it got there. From that tunnel, Sygnia unwound a toolkit built for the router's control plane rather than a generic Linux-on-appliance implant.

A boot-themed script at /etc/rc.d/init.d/grub-rommon launches an implant at /usr/bin/acpid, but only during odd-numbered hours, stopping it on even hours to thin out the actor's footprint during routine inspection. The acpid component loads a modified IOS XR syslog library that drops log messages unless they contain the string "Health," so normal telemetry keeps flowing while the actor's own activity is filtered out. Another binary appends an IOS-style exclude filter to show commands so the tunnel configuration never appears when an administrator lists it. Packet captures pulled from the routers were shipped to an external FTP service.

On the TACACS servers, a toolset Sygnia calls TacTap injects a library, libseconfd.so, into the running tac_plus process, intercepts accepted authentication sessions by handing their file descriptors through a UNIX socket, and writes the captured credentials to /var/log/.tacplus.acct, obfuscated with a single-byte XOR key of 0xEF. That key is the forensic thread: Mandiant previously documented UNC3886 TACACS tooling XORing credential logs with the same 0xEF. Sygnia adds that this specific tac_plus library-injection technique "has not been publicly described before."

On the Linux side of the GRE tunnel, a backdoor named BridgeAgent masquerades as zabbix_agent, a hair off the legitimate daemon name zabbix_agentd, and runs as root under a systemd unit while faking its process name as gnome-shell. The Hacker News notes Mandiant had earlier tied the cluster to a TACACS+ sniffer and a backdoored tac_plus daemon, which is the lineage this new library injection extends.

Some offers on this page may be paid placements or contain affiliate links.