A sophisticated cyber threat group, known as Chinese Fire Ant, has been using compromised Cisco routers to gather sensitive information from organizations around the world. This new tactic involves leveraging administrative access to collect and analyze network traffic, essentially turning these devices into spying platforms.
The discovery was made by researchers at incident response company Sygnia, who analyzed a series of attacks targeting various organizations, including those in critical infrastructure sectors. Fire Ant’s new approach builds on previous tactics, where they targeted VMware hypervisors, TACACS authentication servers, and Linux management hosts to gain initial access.
Once inside, the attackers deployed custom malware that enabled persistence through a fake system service running only during alternating hours. This clever tactic allowed them to remain undetected for an extended period. The malware also selectively suppressed syslog messages to conceal tunnel-related information from legitimate administrators, while establishing outbound Telnet connections to Fire Ant infrastructure and supporting interactive shell access with no logging.
The attackers used their administrative access to capture traffic from multiple routers and upload the resulting PCAP files to external FTP servers. These captures could expose internal topology, administrative connections, authentication flows, routing relationships, and traffic exchanged with connected networks. According to Sygnia, “This behavior shifts the router’s role from a transit device to a collection platform.”
Fire Ant’s operation appears to have involved using compromised routers as covert bridges to explore access paths into connected high-value networks, a tactic dubbed “target behind the target.” The attackers also employed a previously undocumented backdoor called ‘BridgeAgent,’ disguised as a legitimate Zabbix monitoring agent. This backdoor persists as a root-level systemd service and supports TLS reverse shells and the execution of additional payloads on the compromised host.
Interestingly, Sygnia’s research suggests that Fire Ant’s activity strongly overlaps with UNC3886, a Chinese espionage group previously documented by Google. However, while there are similarities in filenames, paths, and implementation details, there are also notable differences.
The discovery highlights the importance of validating system logs and records to ensure they have not been tampered with by attackers. As Sygnia warns, “Logs retrieved from compromised infrastructure should be validated against other data.” The researchers have shared an extensive list of indicators of compromise (IoCs), along with hunting and YARA rules to detect Fire Ant activity.
This incident serves as a reminder that even with robust security measures in place, attackers can still find ways to breach defenses. Organizations must remain vigilant and ensure that their systems are regularly updated and monitored for suspicious activity. By doing so, they can minimize the risk of being caught off guard by sophisticated threat actors like Chinese Fire Ant.
Source: Bleeping Computer — 2026-08-31