A sophisticated threat actor, known as Chinese Fire Ant, has been using compromised Cisco routers as spying platforms, giving them a vantage point to observe traffic moving through trusted network paths. This alarming development has been uncovered by incident response company Sygnia, which has been tracking the group’s activities. Fire Ant’s new tactic involves turning Cisco routers into collection platforms, allowing them to capture sensitive information from multiple routers and upload it to external FTP servers.
The researchers discovered this tactic after finding an active Generic Routing Encapsulation (GRE) tunnel interface on a Cisco IOS XR router that couldn’t be explained by the device’s running configuration or commit history. Further analysis revealed that Fire Ant had deployed custom malware on the devices, enabling persistence through a fake system service that ran the implant only during alternating hours. This stealthy approach allowed the attackers to remain undetected for an extended period.
One of the most disturbing aspects of this tactic is how it shifts the router’s role from a transit device to a collection platform. Once the actor controlled the router, the device became a vantage point for observing traffic moving through trusted network paths. This means that Fire Ant can capture sensitive information such as internal topology, administrative connections, authentication flows, routing relationships, and traffic exchanged with connected networks.
The concealed GRE tunnel connected one compromised router to a legacy Linux server, which Fire Ant used as a staging and reconnaissance system. From there, the attackers probed systems in connected high-value environments, including those associated with critical infrastructure, over ports commonly used for SSH, web services, SMB/RPC, and RDP. Sygnia believes that Fire Ant’s operation aimed to compromise trusted infrastructure at an initial victim and use it as a covert bridge to explore access paths into connected high-value networks.
The researchers also discovered a previously undocumented backdoor called ‘BridgeAgent,’ which Fire Ant disguised as a legitimate Zabbix monitoring agent. The backdoor persists as a root-level systemd service and supports TLS reverse shells and the execution of additional payloads on the compromised host. Sygnia warns that Fire Ant systematically tampers with system logs and records, even changing file timestamps to obscure evidence that would benefit investigators.
As with any sophisticated threat actor, prevention is key. However, once attackers have valid credentials, only 37% of their actions are blocked. This highlights the importance of monitoring systems for anomalies and validating logs against other data sources. Sygnia’s report shares an extensive list of indicators of compromise (IoCs), along with hunting and YARA rules to detect Fire Ant activity.
In light of this discovery, it is essential for organizations to review their network security posture, particularly around Cisco routers and Linux management hosts. They should also ensure that system logs are properly configured and regularly monitored for any signs of tampering or unusual activity. By staying vigilant and proactive, organizations can mitigate the risk of falling victim to Fire Ant’s tactics.
Source: Bleeping Computer — 2026-08-31