Chinese-linked hackers known as Fire Ant have compromised Cisco routers and turned them into covert surveillance platforms, according to incident response firm Sygnia.
The group, which Sygnia says had previously focused on VMware hypervisors, has expanded its activity to Cisco IOS XR routers, TACACS authentication servers and Linux management systems.
Investigators uncovered the operation after finding an active Generic Routing Encapsulation (GRE) tunnel on a Cisco router that did not appear in its running configuration or commit history.
Further examination found custom malware designed to survive on the device through a disguised system service. The implant was configured to run only during alternating hours, a technique intended to reduce the chance of detection.
The malware also interfered with system logging, suppressing messages connected to the tunnel from legitimate administrators. It created outbound Telnet connections to infrastructure controlled by the attackers and allowed interactive shell access without leaving a conventional audit trail.
Cisco routers used to capture network traffic
With administrative control of several routers, Fire Ant was able to capture traffic and send packet-capture files to external FTP servers, Sygnia said.
The data could reveal internal network layouts, administrator connections, authentication exchanges, routing links and communications with connected networks. “This behavior shifts the router’s role from a transit device to a collection platform,” the researchers said.
The hidden GRE tunnel linked one compromised router to an older Linux server, which acted as a staging point for further reconnaissance. From there, the attackers scanned connected high-value environments, including systems associated with critical infrastructure, using ports commonly linked to SSH, web services, SMB and RPC, and remote desktop protocol.
Sygnia described the suspected objective as compromising trusted infrastructure at one organisation and using it as a concealed route into other valuable networks — a method it calls “target behind the target”.
The researchers also identified a previously undocumented backdoor named BridgeAgent. On Linux systems, it was made to resemble a legitimate Zabbix monitoring agent and installed as a root-level systemd service.
BridgeAgent supports encrypted TLS reverse shells and can run additional payloads on an infected host. Sygnia said the backdoor was linked to the GRE tunnel infrastructure used in the operation.
The company said Fire Ant’s activity substantially overlaps with that of UNC3886, a Chinese espionage group previously documented by Google. However, it noted differences in filenames, file locations and technical implementation, meaning the relationship has not been established as identical.
Sygnia warned that the attackers altered system logs and other records, including file timestamps, to make forensic investigation more difficult. It advised organisations to check evidence recovered from compromised infrastructure against independent data sources.
The company has published indicators of compromise, along with threat-hunting guidance and YARA rules intended to help defenders identify Fire Ant activity.
