Your Logs Are Not Evidence If The Infrastructure That Produces Them Can Rewrite The Record

The evidence layer is not a byproduct of your infrastructure — it is infrastructure, and on August 30, Sygnia documented what happens when the evidence layer is captured along with everything else. Fire Ant, a China-nexus threat actor Sygnia has tracked since 2025, spent this year moving past the VMware hypervisors it was previously known for and into the systems that route, authenticate, and manage the environments those hypervisors sit inside: Cisco IOS XR routers, TACACS authentication servers, and the Linux hosts that administer them.

This is not another story about a state actor compromising network equipment. The unusual part is what happened to the evidence. "Fire Ant didn't just compromise systems. It compromised the trust layer those systems depend on," said Asaf Perlman, Sygnia's Director of Incident Response — and the trust layer he's describing is the same one your incident response process depends on every time it opens a log file and treats what's written there as fact.

What Actually Happened

Sygnia's investigation started with a router that lied about its own configuration. A Cisco IOS XR device was running an active GRE tunnel interface with no entry in the running configuration and no commit history to explain how it got there. Tracing that tunnel led to a legacy Linux management host, and from there into TACACS infrastructure and a wider set of connected environments Sygnia describes as a "target behind the target."

The TACACS compromise is the part worth sitting with. Sygnia found a credential-collection toolset it tracks as TacTap, built from an injector — /usr/sbin/acppid — that loads a malicious shared library, /lib/libseconfd.so, directly into the running tac_plus authentication daemon. Once loaded, the library hooks the accept and accept4 system calls the daemon uses to take new TACACS connections. The injector then removes the library from disk after loading it into memory. A filesystem inspection can still show the tac_plus binary as intact, because the component doing the interception was injected into the running process rather than replacing the binary on disk.

In-memory interception, combined with removal of the on-disk artifact after injection, means conventional filesystem inspection is not sufficient to detect the compromise.

TacTap wasn't the only tool. Sygnia also identified BridgeAgent, a second implant that persists on the compromised Linux host by masquerading as a zabbix_agent.service systemd unit — running as root, configured to restart automatically, disguised as the monitoring infrastructure an operations team would normally trust by default. Sygnia's own report describes the actor as having "manipulated the evidence layer" — suppressing router logs, hiding commit activity, filtering AAA requests, suppressing SNMP traps, and filtering command output. On the compromised Linux hosts: SELinux disabled, login-history records rewritten, privileged-command entries removed from system logs.

One detail worth including without overclaiming it: the TACACS credentials TacTap captured were obfuscated with a single-byte XOR key of 0xEF — the same key Mandiant previously documented in UNC3886's tooling, LOOKOVER. Sygnia treats this as tooling overlap that strengthens its assessment of overlap with UNC3886, not as independent proof of shared identity. Tooling similarity is corroborating evidence. It isn't attribution.

Four ways the record was compromised, not one:

• Authentication interception — libseconfd.so hooked into tac_plus, capturing sessions in memory with no on-disk artifact to find
• Persistence disguised as monitoring — BridgeAgent running as a fake Zabbix systemd service, hiding in the tooling defenders already trust
• Active evidence suppression — router logs, AAA requests, SNMP traps, and command output filtered or hidden in real time
• Historical record rewriting — wtmp/utmp/btmp modified, privileged-command entries removed after the fact

The Assumption Underneath "Check The Logs"

Every incident response playbook treats telemetry as an observation of the system rather than as another system that can itself be compromised. A log file is data about an event. A router is infrastructure. Those feel like different categories, and the entire discipline of "go check the logs" depends on that distinction holding.

Fire Ant's TACACS compromise collapses it. The router that generates the log, the authentication daemon that records the session, and the management host that stores the history are not neutral instruments standing outside the incident. They're infrastructure — the same category of thing as the servers and workloads they're supposedly reporting on — and infrastructure can be compromised.

"Check the logs" is an architectural assumption about where the attacker's authority stops, not a permanent capability of the infrastructure that produces them.

The Evidence Layer Inside The Blast Radius

The mechanism is easiest to see as a chain: attacker gains a foothold in infrastructure that sits between production systems and the people administering them; that infrastructure is the same infrastructure responsible for generating telemetry about itself; because the evidence source remains inside an authority boundary the attacker has already crossed, the attacker can shape what gets recorded at the point of creation rather than falsifying it after the fact; investigators inherit a record that looks complete and reads as authoritative, with no visible gap to signal anything is wrong.

The critical failure is at the telemetry step, not the initial compromise. Compromise is not unusual. What's structural here is that the evidence source remains inside an authority boundary the attacker has already crossed, so the telemetry produced during the incident is not independent of the incident. That's a materially different problem than a logging gap — a gap means the record is incomplete and everyone knows it. This is worse: the record can be complete, internally consistent, and still not truthful, with no missing field to flag it.

Worth distinguishing from a related pattern: persistence surviving remediation is a case where recovery actions succeed but never reach the layer where an attacker's access actually lives — a scoping failure in the response. Fire Ant is different: the infrastructure used to establish what happened in the first place is the thing that's compromised. And it's a different failure than a pure evidence gap, where no artifact connecting execution to authorization ever existed at all — absence is a known problem with known mitigations. A confident, complete, false record doesn't announce itself the same way.

Evidence Independence, Not Telemetry Redundancy

Sygnia's own recommendation for defenders is a cross-validation standard, not a bigger dashboard: routers, TACACS servers, hypervisors, and jump hosts should all be treated as first-class forensic assets, and investigators should validate what the logs say against memory, disk, network traffic, authentication records, and configuration state, rather than trusting any single telemetry source on its own.

Telemetry redundancy is not the same thing as evidence independence. Sending logs to a second location, keeping a longer retention window, or standing up a SIEM that ingests everything doesn't automatically produce independent evidence — it produces more copies. If the second location, the retention system, and the source all sit under the same administrative authority, and that authority is the thing an attacker has compromised, you don't have ten independent witnesses. You have ten copies of the same testimony.

A copy of evidence is independent only if the attacker cannot exercise the same authority over both the original and the copy. That's a trust-boundary question, not a storage-location question. A log shipped to a SIEM that authenticates through the same TACACS infrastructure Fire Ant compromised isn't independent of that compromise — it's downstream of it.

The operational question every data protection program should be able to answer isn't "do we log enough" — it's "if the systems generating our evidence were compromised today, which of our evidence sources would still be independent of that compromise, and which would just be more copies of the same thing." If the honest answer is that most telemetry shares an authority path with the infrastructure it's supposed to be watching, that's the actual gap. Fixing it is an architecture decision about where authority boundaries sit, not a retention-policy adjustment.

The Bottom Line

Fire Ant's TACACS compromise is a specific, well-documented technique — an injected library hooking authentication calls in memory, removed from disk after loading, paired with a second implant disguised as monitoring infrastructure. But the technique isn't the argument. The argument is that the systems generating your incident evidence can be inside the same trust boundary as the incident itself, and when they are, "check the logs" stops being a neutral first step.

Most data protection architecture treats evidence as a byproduct — something infrastructure produces as a side effect of doing its real job. Fire Ant is a demonstration of what happens when that assumption is wrong: evidence generation is a function infrastructure performs, not a passive record of one.

Evidence needs an independence boundary, not a retention policy.

Originally published at rack2cloud.com