A China-linked hacking group has been caught embedding custom malware directly inside network routers and authentication servers, using the access to intercept passwords and erase evidence of its own presence, according to a new report from the incident response firm Sygnia.
The group, which Sygnia tracks under the name Fire Ant, was first documented in 2025 for compromising virtualization software such as VMware ESXi and vCenter. The firm’s latest investigation, published August 27, 2026, shows the group has since expanded its focus to the infrastructure that underpins corporate networks: edge routers, authentication systems and the Linux servers used to manage them.
Investigators began pulling the thread after noticing something that should not have existed: a tunnel interface active on a Cisco IOS XR router that appeared nowhere in the device’s saved configuration or change history. That tunnel, built using the Generic Routing Encapsulation protocol, connected the router to a compromised Linux system that Sygnia calls “BridgeAgent,” which the attackers had disguised as a legitimate Zabbix network monitoring agent, complete with a fake process name mimicking a desktop application to avoid drawing attention from anyone reviewing running processes.
Perhaps the most notable technique documented in the report targets TACACS, a protocol many organizations rely on to centrally authenticate administrators logging into network equipment. Sygnia found that Fire Ant had injected a malicious shared library directly into the memory of a running TACACS server process, allowing it to quietly intercept authentication traffic passing through the server and record credentials as they were used, all without altering any file that a routine integrity check would flag. Sygnia said this specific library-injection technique targeting TACACS had not been publicly documented before, calling it “a notable evolution of Fire Ant’s TACACS-focused credential collection tradecraft.”
On the compromised Cisco routers themselves, the group deployed tools that selectively edited system logs to hide their own activity while leaving everything else intact, making the tampering far harder to spot than simply wiping logs wholesale. On Linux systems the group had reached, researchers found further anti-forensic work: login records altered to remove traces of the attacker’s source IP addresses, sudo command history deleted, and security software like SELinux weakened or disabled.
Sygnia stopped short of formally attributing the campaign to a specific named threat actor but said the tradecraft “strongly overlaps” with UNC3886, a China-nexus espionage group tracked separately by Google-owned Mandiant that has also focused on virtualization and edge infrastructure. The firm said the goal of the campaign appeared to be using the compromised network equipment as a bridge to reach other, more sensitive systems connected to it, including some tied to critical infrastructure. “When trusted infrastructure is compromised, an attacker can gain both a path into connected environments and the ability to obscure how that access was used,” the firm wrote.
Cisco networking equipment has drawn heightened scrutiny throughout 2026. We previously covered nine critical vulnerabilities Cisco patched in its Crosswork and Secure Workload platforms just over a week before this report, five of which scored a maximum 10.0 severity rating. The Fire Ant campaign is a separate matter, since it involves attacker-deployed malware on already-compromised systems rather than a flaw in Cisco’s code, but both stories point to the same concern: network equipment sitting at the edge of corporate networks is an increasingly attractive target for sophisticated attackers.
Sygnia has not disclosed which organizations were affected by the Fire Ant campaign. Network defenders are advised to audit TACACS server processes for unexpected loaded libraries, review router configurations against known-good baselines rather than relying solely on saved configuration files, and treat any unexplained GRE tunnel interface as a potential indicator of compromise.
Source: Sygnia, “Fire Ant Evolves: From Hypervisors to Trusted Infrastructure”
