A Chinese threat actor has repurposed Cisco routers into active surveillance platforms in what incident response company Sygnia describes as a pivot away from Fire Ant Cisco router spying techniques previously focused on virtualisation infrastructure. The group has deployed custom malware, captured live network traffic, and used compromised devices as covert bridges into connected high-value environments, including systems associated with critical infrastructure.
From VMware to IOS XR: How Fire Ant Changed Targets
Sygnia had previously tracked Fire Ant targeting VMware ESXi and vCenter environments, according to Cybersecurity Dive. The shift to Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts represents a deliberate move toward trusted network infrastructure, devices that sit at the heart of enterprise and service-provider environments and carry enormous amounts of sensitive traffic.
Researchers first noticed something was wrong when they found an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by the running configuration or commit history. That anomaly became the thread that unravelled the campaign.
Purpose-Built Malware for the Router Control Plane
Further analysis revealed that Fire Ant had deployed custom malware directly engineered for the IOS XR environment. According to Sygnia, the malware’s components interacted directly with IOS XR logging, command execution, routing, VRF resolution, AAA, and Telnet-management functions, purpose-built tooling, not generic implants ported across from a different platform.
Persistence was maintained through a fake system service that ran the implant only during alternating hours, a mechanism designed to reduce the window in which anomalous behaviour might be detected. The malware also selectively suppressed syslog messages to hide tunnel-related information from legitimate administrators, established outbound Telnet connections back to Fire Ant infrastructure, and supported interactive shell access that generated no logging whatsoever.
The concealed GRE tunnel connected one compromised router to a legacy Linux server, which Fire Ant used as a staging and reconnaissance system. From that position, the attackers probed systems in connected high-value environments over ports commonly associated with SSH, web services, SMB/RPC, and RDP.
Fire Ant Cisco Router Spying Turned Devices into Collection Platforms
Beyond persistence, Fire Ant used their administrative access to capture live traffic from multiple routers and upload the resulting PCAP files to external FTP servers. Those captures had the potential to expose internal topology, administrative connections, authentication flows, routing relationships, and traffic exchanged with connected networks, a comprehensive intelligence haul from a single vantage point.
‘This behavior shifts the router’s role from a transit device to a collection platform,’ Sygnia explains. ‘Once the actor controlled the router, the device became a vantage point for observing traffic moving through trusted network paths.’
Sygnia calls the broader strategy ‘target behind the target’: compromise trusted infrastructure at an initial victim and use it as a covert bridge to explore access paths into connected, higher-value networks. It is a patient, methodical approach that exploits the implicit trust organisations place in their own core infrastructure.
BridgeAgent Backdoor and Links to UNC3886
Researchers also uncovered a previously undocumented backdoor named ‘BridgeAgent,’ which Fire Ant disguised as a legitimate Zabbix monitoring agent. The backdoor persists as a root-level systemd service and supports TLS reverse shells along with the execution of additional payloads on the compromised host.
The connection to a wider Chinese espionage effort is not new territory for this toolset. UNC3886, a Chinese espionage group previously documented by Google, has previously targeted Juniper MX routers using custom backdoors as part of a wider espionage effort. Sygnia says Fire Ant activity strongly overlaps with UNC3886, though researchers note differences in filenames, paths, and implementation details that stop short of a definitive merger of the two clusters.
Fire Ant systematically tampers with system logs and file timestamps to obscure forensic evidence, and Sygnia warns that logs retrieved from compromised infrastructure should be validated against other data sources before being trusted. To assist defenders, Sygnia’s report includes an extensive list of indicators of compromise alongside hunting queries and YARA rules for detecting Fire Ant activity.
