Fire Ant: China's APT that hijacks Cisco routers to silently spy

Fire Ant, a group linked to Chinese intelligence services, is compromising Cisco routers to intercept credentials and falsify security logs. A persistent eavesdropping strategy that is difficult to detect—and can last for months.

What

The APT group Fire Ant, attributed to Chinese intelligence services, has expanded a long-running espionage campaign—originally targeting VMware hypervisors—to now compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts used to route, authenticate, and administer high-value networks. Two primary goals: stealing network credentials and blinding security logs.

Who is impacted

Organizations using Cisco IOS XR routers at the network edge (typically carrier-grade routers: ASR, NCS series), TACACS+ servers for network authentication, and Linux admin workstations—particularly in government, defense, telecommunications, and critical infrastructure sectors.

How it works

Fire Ant exploits vulnerabilities in the management interfaces of these devices to:

1. Install backdoors in device firmware—persistent even after reboots
2. Intercept network traffic passing through the router: plaintext credentials, authentication tokens, VPN sessions, and TACACS+ authentication exchanges
3. Falsify logs to maintain an appearance of normalcy—modified timestamps, deleted or altered entries
4. Pivot into victims' internal networks via the privileged network access of compromised devices

The falsification of timestamps is particularly sophisticated: not just deleting entries, but rewriting them to preserve the apparent consistency of logs.

Analysis

This campaign represents a geographic and technical expansion: Fire Ant was previously documented primarily on VMware; the shift to physical network infrastructure (IOS XR, TACACS, Linux) signals a rise in ambition. Compromising an edge router or TACACS server grants privileged access to an organization’s entire traffic and authentication flows.

The strategy is one of long-term persistent access—establishing durable listening posts rather than exfiltrating data in bulk. Organizations may be compromised for months without detection. In July 2026, the FBI dismantled the QTFY infrastructure of another Chinese group—the Fire Ant adapts its methods to survive takedowns.

What to do now

• Audit the integrity of Cisco IOS XR logs (compare with out-of-band syslog archives)
• Update IOS XR to the latest stable versions, as well as TACACS+ servers
• Disable management interfaces exposed to the internet (Telnet, unencrypted HTTP)
• Export syslogs to an immutable external SIEM immediately—logs already sent cannot be retroactively falsified
• Review Fire Ant IOCs published by national CERTs