DEV Community

Anoymask
Anoymask

Posted on

Fire Ant: Cisco IOS XR, TACACS, and Linux Management Infrastructure Hijacked into Spying and Access Platforms

#security #threatintel

1. Overview

  • Title: Chinese Fire Ant hackers turn Cisco routers into spying platforms
  • Publisher: BleepingComputer
  • Publication Date: 2026-08-31
  • Original Source: BleepingComputer
  • Related Sources: Sygnia
  • Related Malware, Threat Groups, CVEs, Products: Fire Ant, BridgeAgent, TacTap, Medusa rootkit, Cisco IOS XR, TACACS+, Linux, Zabbix
  • Severity: High

2. Executive Summary

Fire Ant compromised Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. The actors used GRE tunnels, suppressed logs and CLI outputs, captured network traffic, stole credentials, and deployed multiple long-term backdoors to explore connected high-value networks.

3. Attack Flow

Turning Trusted Management Infrastructure into Relay Points

  1. Fire Ant gains high-privileged access to Cisco IOS XR routers and Linux management hosts. The initial access vector is not disclosed.
  2. The actors place persistence scripts and IOS XR-specific components on the routers, manipulating syslog and show outputs.
  3. They operate GRE tunnels with VRF and outbound Telnet connections that rarely appear in configurations or history logs.
  4. They capture network traffic into PCAP files on the routers and send them to external FTP servers to gather internal network topology and authentication flows.
  5. They deploy BridgeAgent, rootkits, custom SSH, and packet-triggered backdoors on the GRE-connected Linux hosts.
  6. They inject libraries into tac_plus using TacTap to harvest TACACS credentials.
  7. They probe connected SSH, HTTP(S), SMB/RPC, and RDP services to verify reachability to high-value networks, including critical infrastructure.

4. Threat Actor Positioning and Execution Environment

  • External actors with high-privileged access to routers, TACACS servers, and Linux management hosts. The initial access vector is unknown.
  • After the compromise, they explore connected target networks from inside organizational interconnections and management paths.

5. Visibility for Victims and Administrators

Victims

  • The activity rarely appears directly on end-user screens; it manifests as minor network or authentication anomalies.

Administrators

  • Clues include unexpected GRE tunnels, discrepancies between show outputs and actual system states, missing syslog/AAA/SNMP logs, router-originated PCAPs and FTP traffic, TACACS credential files, and fake services.

6. Success Conditions and Failure Conditions

Success Conditions

  • Execution of high-privileged code on routers or management hosts.
  • Connectivity from the management plane to external C2 servers and target networks.
  • Lack of independent validation for TACACS and logging infrastructure, combined with reliance on management device displays.

Failure Conditions / Risk Mitigation

  • Isolate the management plane from business networks and external access, enforcing allowlisting for destinations.
  • Cross-check router run-state, configurations, commits, memory, files, and flows using independent sources of truth.
  • Monitor TACACS servers and Linux management hosts for file integrity, process injection, and credential files.
  • Rebuild systems from known-good images upon compromise, and rotate management credentials and trust relationships.

7. Impact of Successful Attacks

  • Traffic monitoring via routers, hidden tunnels, and exploration of connected target networks.
  • Theft of TACACS and SSH credentials, enabling impersonation of legitimate administrators.
  • Interference with investigations through the modification of logs, configuration displays, and authentication records.
  • Lateral movement to connected external parties and critical infrastructure.

8. Observable Logs

  • Email: Not applicable.
  • Proxy/SWG/DNS: Unknown HTTPS, FTP/SCP traffic from management hosts, outbound Telnet, and encrypted configuration retrieval.
  • Endpoint/EDR: /usr/bin/acpid, BridgeAgent, acppid/libseconfd.so, /usr/lib/locate, cupsdd, smartdd, deleted running processes, and modifications to SELinux/iptables.
  • Identity/IdP: Missing TACACS authentication and command logs, management commands executed without login records, /var/log/.tacplus.acct, and remote.txt.
  • SaaS/Cloud: When connected to cloud management infrastructure, identify new sessions originating from stolen management credentials.
  • Network: Unexplained GRE tunnels and VRFs, router-originated PCAP and FTP traffic, SSH/HTTP/SMB/RDP scanning originating from Linux GRE terminators, and SSH port forwarding on alternative ports.

9. Attack Success Assessment

  • Attack Attempt Observed (Success Unconfirmed): Detection of reconnaissance or reachability checks against management devices, with no confirmed intrusion.
  • User Interaction Confirmed: This activity does not require end-user interaction. Unauthorized use of administrator credentials is treated as a separate authentication success.
  • Initial Execution Confirmed: Identification of unknown components, fake services, or unconfigured GRE tunnels on IOS XR or Linux.
  • Malware Execution or Authentication Success Confirmed: Confirmation of BridgeAgent, TacTap, rootkits, custom SSH, or access via stolen management credentials.
  • Data Theft or Session Compromise Confirmed: Confirmation of PCAP collection, TACACS/SSH credential theft, or the acquisition and external transmission of authentication sessions. Sygnia observed credential and PCAP extraction.
  • Subsequent Compromise Confirmed: The stage where the threat actor scans or breaches target networks via GRE tunnels or management hosts. Reachability probes were observed, but successful compromise across all target destinations remains unconfirmed.

10. Investigation Playbook

  • Trigger: Detect unexplained GRE tunnels, PCAP/FTP traffic originating from management devices, inconsistencies in TACACS logs, or fake services.
  • Initial Verification: Independently preserve device running/candidate configurations, commits, memory, files, and external NetFlow data.
  • Endpoints: Check for IOS XR known IOCs, Linux systemd services, rootkits, deleted processes, /var/tmp, /usr/lib/locate, iptables, and SELinux.
  • Identity/Cloud: Cross-reference TACACS, SSH, administrator sessions, and command logs to identify missing records or IP rewriting.
  • Follow-up Actions: Investigate GRE endpoints, targeted PCAPs, connected SSH/HTTP/SMB/RDP services, external connections, and potential impact on critical infrastructure.
  • Containment: Isolate the management plane, rebuild from known-good images, rotate TACACS/SSH credentials and keys, and re-authorize trusted connections.
  • Classification Categories: Differentiate between reachability checks, router compromises, log tampering, credential theft, tunneling, target reconnaissance, and third-party compromises.

11. Defense and Detection Ideas

  • Single Event: A GRE interface running that does not exist in the running configuration, or discrepancies between show output and independent network flows.
  • Time-Series Correlation: Correlate device anomalies, missing syslog/AAA logs, PCAP/FTP activity, GRE usage, Linux scanning, and TACACS credential theft as part of a long-term asset relationship.
  • Threat Hunting: Search for tac_plus injections, XOR 0xEF credentials, deleted running processes, and log tampering via utmpdump/sed, in addition to Sygnia's IOCs and YARA rules.
  • Log Gaps: Because attackers can manipulate device displays and logs, independent NetFlow, authentication, memory, and configuration management sources are required.
  • Priority Mitigations: Prioritize management plane isolation, outbound traffic restriction, TACACS protection, integrity monitoring, and recovery from known-good images.

12. Facts / Inference / Hypothesis

Facts

  • The investigation started after discovering an active VRF-enabled GRE tunnel that was absent from the running configuration and commit history.
  • IOS XR tooling included /usr/bin/acpid, /pkg/bin/dhcpd_show_issu_status, and /pkg/bin/hd, which implemented odd-hour execution, syslog suppression, outbound Telnet connections, and the concealment of show outputs.
  • BridgeAgent on the target Linux host maintained root persistence via systemd, read encrypted configuration settings in /opt/.ICEauthority, and provided HTTPS polling and a TLS reverse shell.
  • TacTap injected libseconfd.so into tac_plus to intercept accepted TACACS sessions and saved obfuscated credentials (using XOR 0xEF) to /var/log/.tacplus.acct.
  • Fire Ant generated PCAPs on routers and sent them to external FTP servers, while combining SSH credentials, rootkits, custom SSH, and packet-triggered backdoors on the Linux side.
  • Multiple Linux access components were deployed in 2025 and reused in 2026 operations.

Inference

  • When router, TACACS, and management host logs are compromised simultaneously, a single audit trail cannot distinguish between legitimate administrative actions and attacker activity.

Hypothesis

  • While there are technical similarities between Fire Ant and previously reported UNC3886 activity, public information alone is insufficient to definitively attribute all activities in this incident to a single threat actor.

13. MITRE ATT&CK Mapping

  • T1572 Protocol Tunneling (High): Used GRE, Telnet, and TLS reverse shells for target reconnaissance and relaying.
  • T1040 Network Sniffing (High): Collected PCAPs on routers and transmitted them to external FTP servers.
  • T1056 Input Capture (High): Harvested TACACS credentials using libraries injected into tac_plus.
  • T1014 Rootkit (High): Deployed Medusa-related components and REPTILE-based cloaking components on the Linux management infrastructure.
  • T1562.001 Impair Defenses: Disable or Modify Tools (High): Modified syslog, AAA, SNMP, CLI outputs, SELinux, and iptables.
  • T1070.002 Indicator Removal: Clear Linux or Mac System Logs (High): Rewrote IP addresses in wtmp/utmp/btmp and removed sudo entries from messages/secure.

14. Unknowns and Further Investigation

  • The initial access vector into Cisco IOS XR, the number of compromised organizations, and the scope of successful compromises within connected critical infrastructure.
  • The full scope of subsequent compromises utilizing the acquired PCAPs and credentials.

15. Impact on SOCs

For telecommunications providers, data centers, managed service providers (MSPs), and critical infrastructure operators, management routers and TACACS servers form trust boundaries between organizations. Security teams must not rely solely on configuration displays and commit histories, but must cross-reference memory, files, NetFlow, external observations, and authentication records.

16. Summary by Target Audience

  • For SOCs: Conduct cross-organizational investigations for unexplained GRE tunnels, discrepancies between configurations and run-states, router-originated PCAP/FTP traffic, tac_plus injections, deleted running processes, and log tampering.
  • For Administrators: Isolate IOS XR routers, TACACS servers, and Linux management hosts to Tier 0 equivalents, and verify integrity using known-good images, configurations, and external network flows.
  • For Users: This attack does not rely on end-user interaction. Report any management anomalies or authentication notifications immediately.

Top comments (0)