China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

A China-linked cyber espionage group known as Fire Ant has been found to be targeting Cisco IOS XR routers, as well as TACACS servers and Linux management hosts. This expansion is part of a long-running campaign that previously focused on VMware hypervisors. The goal of the campaign is to compromise high-value networks used for routing, authentication, and management. The incident response firm Sygnia investigated the intrusion and found that Fire Ant's actions allow them to steal credentials and disrupt security logs. Fire Ant's ability to blind security logs makes it difficult to detect their presence. The campaign highlights the group's ability to adapt and expand its targets.