Fire Ant’s Cisco Router Intrusions: Rotate Credentials Beyond the Compromised Trust Layer

Incident-response firm Sygnia has documented a China-nexus espionage actor using Cisco IOS XR routers, TACACS authentication servers and Linux management hosts as a credential-collection and access layer. The actor, tracked by Sygnia as Fire Ant, did more than maintain a foothold on ordinary endpoints. It operated from systems that route traffic, authenticate administrators and create the evidence defenders normally trust.

Sygnia's findings come from an investigation in an unnamed environment. They do not establish that every Cisco IOS XR deployment is affected, that a new Cisco vulnerability caused the intrusion or that every connected critical-infrastructure network was compromised. The initial access path remains undisclosed.

What Sygnia found

The investigation began with a GRE tunnel operating on a Cisco IOS XR router even though no corresponding running configuration or commit history explained it. Sygnia says the actor used purpose-built router implants to manipulate syslog delivery, filter command output and maintain covert connectivity. The compromised routers also captured traffic, with packet captures transferred to external infrastructure.

Fire Ant also targeted TACACS infrastructure, a control point commonly used to authenticate administrative access to network devices. Sygnia recovered tooling it calls TacTap, designed to intercept authentication flows and collect credentials. On Linux management systems, the actor deployed persistent backdoors, including a component disguised as a Zabbix service.

From this trusted position, the actor explored routes into connected high-value environments. Sygnia calls the model “target behind the target”: compromise an organization whose routing and management relationships can provide visibility or reach into another organization. Public reporting says activity against some connected critical-infrastructure systems was limited to scanning and connection attempts; it does not confirm successful compromise of those systems.

When the control plane lies, ordinary recovery assumptions fail

A router normally tells administrators what interfaces exist, a TACACS server records who authenticated and a log platform reconstructs what happened. Fire Ant reportedly interfered with all three. That changes the recovery question from “which password should we reset?” to “which systems are still trustworthy enough to issue, deliver and verify the replacement?”

Rotating a network-administrator password through the same compromised management path can expose the new value. Reusing the affected identity provider, jump host or ticketing system may also preserve an attacker's access through sessions, keys or alternate accounts. Credential rotation has to follow containment and a documented trust-boundary decision, not merely a password-reset button.

A clean credential-recovery sequence

Define the affected trust layer. Include routers, TACACS or RADIUS systems, jump hosts, hypervisors, management workstations and the telemetry used to validate them.
Establish known-clean administration. Use verified endpoints and a management path outside the suspected environment before creating replacement secrets.
Preserve independent evidence. Compare device state with memory, disk, network captures, authentication records and external logging rather than trusting one appliance's output.
Remove persistence before final rotation. Rebuild or validate affected infrastructure, remove hidden accounts and services, and confirm boot-time integrity.
Rotate the complete credential set. Cover administrator passwords, local device accounts, TACACS shared secrets, SSH keys, API tokens, certificates, recovery codes and active sessions.
Verify recipients out of band. Use pre-established contacts and two-person approval for high-impact network access.
Keep plaintext out of the incident transcript. Record authorization and custody without pasting replacement values into email, chat or tickets.
Rotate again after confidence is restored. Temporary credentials used during uncertain containment should not become permanent production access.

Where Secretus fits—and where it does not

Secretus can deliver a temporary password, API token or recovery value through a one-time encrypted link instead of leaving plaintext in a persistent collaboration history. Short expiry limits the delivery window, and Team Split can require multiple approved holders before a high-impact recovery secret is reconstructed.

This helps only after the team has verified the recipient and selected a known-clean endpoint. Secretus cannot make a compromised browser trustworthy, detect an implanted router, establish a person's identity or revoke an existing session. A secure handoff is one step in rebuilding trust; it is not evidence that the surrounding environment is clean.

What remains unknown

Sygnia has not named the affected organizations, disclosed the initial access vector or published a complete victim count. Its assessment says Fire Ant strongly overlaps with public reporting on UNC3886, but differences remain and the attribution should be treated as an intelligence assessment. Cisco has not published a Fire Ant-specific advisory, and the public evidence does not identify one vulnerability that organizations can patch to close the entire intrusion path.