Possibly linked to UNC3886, attackers deploy router malware, intercept credentials and traffic, conceal tunnels, and seek pathways into connected critical environments

According to a report released on 30 August 2026 by an Israel-based incident response firm, a China-linked cyber espionage group known as Fire Ant has shifted its focus from VMware hypervisors to Cisco routers, TACACS authentication servers, and Linux management hosts, turning core networking gear into covert surveillance platforms.

The campaign had apparently started in 2025, continued into 2026, and now abuses the trusted infrastructure that routes traffic, authenticates administrators, and manages high-value enterprise and critical-infrastructure networks, according to a Business Wire report.

The investigation began after analysts spotted an active Generic Routing Encapsulation tunnel interface on a Cisco IOS XR router that could not be explained by the device’s running configuration or commit history, indicating the router’s operational state had been tampered with. Once inside, Fire Ant had used its administrative access to capture traffic from multiple router interfaces and upload the resulting PCAP files to external FTP servers, potentially exposing internal topology, authentication flows, routing relationships, and traffic exchanged with connected networks. Also:

• The group deployed custom malware purpose-built for the IOS XR control plane, with components that interacted directly with logging, command execution, routing, VRF resolution, AAA, and Telnet-management functions.
• A persistence script at /etc/rc.d/init.d/grub-rommon then launched an implant disguised as /usr/bin/acpid on alternating hours, while another component selectively suppressed syslog messages and altered command output so that “show” commands could hide tunnel-related details
• The attackers also targeted TACACS, the service that authenticates and records network-device administration, using a credential-collection toolset. On the TACACS server, an injector named acppid loaded a malicious library into the running tac_plus authentication process, hooked the functions that accept new connections, and passed live session handles to a second process over a local Unix socket
• Captured credentials were written to /var/log/.tacplus.acct and lightly obfuscated with a single-byte XOR key of 0xEF. On legacy Linux hosts, Fire Ant deployed a masquerading implant configured for tunneling and persistence through a zabbix_agent.service systemd unit set to run as root with automatic restart behavior
• Fire Ant’s approach has been described as a “target behind the target” strategy, compromising trusted infrastructure at one organization to explore access paths into other connected high-
• value environments, including critical infrastructure, according to Bleeping Computer. The activity strongly overlaps with that of UNC3886, a Chinese espionage group, although differences in filenames and implementation details remain.
• The campaign adds to a pattern of state-sponsored actors targeting networking equipment, following earlier compromises of Juniper routers and recurring interest in Cisco devices because of the trusted access they provide.

Sygnia, the firm sharing its investigations, has urged security teams to restrict privileged access to network management infrastructure, monitor for unexpected tunnel interfaces, and centralize authentication telemetry outside of managed devices so that evidence on a compromised system cannot be easily manipulated.