The investigation started with a tunnel nobody had configured. On a Cisco IOS XR router, a GRE tunnel interface was up and bound to a VRF, with no running configuration and no commit history to explain how it got there.
That single inconsistency meant the router could no longer be trusted to describe itself.
Incident response firm Sygnia says the device sat in a network compromised by Fire Ant, a China-nexus espionage actor it first reported in 2025. Back then the group lived in VMware ESXi and vCenter. In 2026 it moved to the layer underneath: the routers, authentication servers and Linux management hosts that decide who reaches what, which credentials are trusted, and which logs exist afterwards.
A victim chosen for what it connects to
Sygnia's central finding is that Fire Ant was not only after the organization it had broken into. That environment carried routing, connectivity and administrative access for other networks, so the actor used it as a platform to probe outward. From a legacy Linux host at the far end of the GRE tunnel, investigators recorded repeated connection attempts against SSH, HTTPS, SMB and RDP ports on connected high value environments, including systems tied to critical infrastructure. "Fire Ant didn't just compromise systems. It compromised the trust layer those systems depend on," said Asaf Perlman, Sygnia's director of incident response.
Routers that listen instead of route
Inside the routers, the group turned them into collection points. Using a legitimate administrative account, it captured traffic from several Cisco routers and uploaded the packet captures to external FTP servers, one of which appeared to have been stood up the same day. Router captures expose internal topology, management sessions, authentication flows and routing relationships, far more than any endpoint gives.
Malware built for the control plane
A persistence script at /etc/rc.d/init.d/grub-rommon posed as a legitimate service and launched an implant from /usr/bin/acpid only during odd numbered hours, keeping the process out of view during routine inspection. That implant carried a modified IOS XR syslog library whose wrapper forwarded a log message only when it contained the string "Health", returning a success value without sending anything otherwise. A second binary posing as /pkg/bin/dhcpd_show_issu_status held a hardcoded external address and Telnet client code, and a component at /pkg/bin/hd rewrote the command execution path to append an exclude filter to show commands, hiding the tunnel from administrators.
Owning the turnstile, not the door
Fire Ant then went after the systems that validate administrators. On the TACACS server, Sygnia found a VMCI socket backdoor under /var/tmp/audit and a credential collection toolset it tracks as TacTap, which used library injection to intercept accepted sessions. On the Linux side, an implant Sygnia names BridgeAgent posed as zabbix_agent, persisted through a zabbix_agent.service systemd unit running as root, renamed itself to resemble /usr/bin/gnome-shell, and kept its command and control settings AES encrypted in /opt/.ICEauthority. It also launched a second binary, ntfsfixed, marked with the string KS2ow2232ssww2342234323.
Treat routers like endpoints, not plumbing
The hardest part for responders was that the actor attacked the evidence itself: suppressing router logging and SNMP traps, hiding commit activity, filtering command output, disabling SELinux and tampering with host logs. No single telemetry source could reconstruct the activity. Sygnia's guidance is to validate logs against memory, disk, network and configuration evidence together, and to give routers, TACACS servers and jump hosts the same monitoring as ordinary servers.
Sygnia tracks a separate long running intrusion at this same layer as Velvet Ant, which sat inside one critical network for close to a decade. Espionage crews and criminal groups now converge on the same neglected edge and management devices, and China linked operations are their most persistent occupants. The uncomfortable implication here is that one network's compromise was never the objective, only the address.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.