China-linked hackers exploit Cisco routers as espionage platforms, Sygnia finds

A China-linked threat actor known as Fire Ant has expanded its espionage operations from VMware environments into Cisco ↘ 1.12% routers, compromising core network infrastructure to collect credentials, capture traffic, and establish long-term footholds in high-value networks, according to research published Sunday by cybersecurity firm Sygnia.sygnia

The campaign marks an evolution for Fire Ant, which gained attention in 2025 for exploiting VMware ESXi and vCenter environments. The group is now targeting Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts — infrastructure that organizations often overlook as legacy technology but that serves as the backbone for routing and access control.cybersecuritydive

Inside the Attack

Sygnia's investigation began after researchers discovered an active Generic Routing Encapsulation tunnel interface on a Cisco IOS XR router that could not be explained by the device's running configuration or commit history, indicating the router's operational state had been tampered with.bleepingcomputer

"Fire Ant didn't just compromise systems. It compromised the trust layer those systems depend on," said Asaf Perlman, director of incident response at Sygnia. The attackers turned routers into collection platforms, capturing traffic from multiple devices and uploading the resulting PCAP files to external FTP servers. These captures could expose internal topology, authentication flows, and traffic exchanged with connected networks.sygnia+1

The group deployed two novel tools: BridgeAgent, a backdoor disguised as a legitimate Zabbix monitoring agent that supports TLS reverse shells, and TacTap, a credential-collection toolset that intercepts authentication sessions on TACACS servers. Fire Ant also systematically manipulated logs, suppressed syslog messages related to tunnel activity, and modified file timestamps to hinder forensic investigation.cybersecuritydive+2

A Broader Pattern

Sygnia described Fire Ant's approach as a "target behind the target" strategy — compromising trusted infrastructure at one organization to explore access paths into other connected high-value environments, including critical infrastructure. The firm said the activity strongly overlaps with UNC3886, a Chinese espionage group previously documented by Google Alphabet Inc. ↗ 1.06%, though differences in filenames and implementation details remain.sygnia+1

The campaign adds to a pattern of nation-state actors targeting networking equipment. UNC3886 previously compromised Juniper MX routers using custom backdoors, and Cisco devices have been a recurring target for sophisticated threat groups because of the trusted access they provide.cybersecuritydive

Growing Concerns

The findings arrive amid broader warnings about state-backed cyber threats to critical infrastructure. A recent CISA advisory detailed malicious activity targeting more than 100 internet-exposed systems in the water and wastewater sector in July 2026, while analysts have warned that nation-states may have accumulated footholds across key industry verticals on a systemic basis.iapp

Sygnia urged security teams to restrict privileged access to network management infrastructure, monitor for unexpected tunnel interfaces, and centralize authentication telemetry outside of managed devices so that evidence on a compromised system cannot be easily manipulated. A Cisco spokesperson was not immediately available for comment.cybersecuritydive