The Chinese threat actor 'Fire Ant' has shifted its focus to compromising Cisco routers, using custom malware and hidden GRE tunnels to turn networking hardware into covert surveillance hubs.
- Fire Ant deployed custom malware on Cisco IOS XR routers to create hidden GRE tunnels.
- The group used a fake system service that operated only during alternating hours to evade detection.
- A new backdoor called 'BridgeAgent' was discovered, disguised as a Zabbix monitoring agent.
- The operation follows a 'target behind the target' strategy to breach high-value critical infrastructure.
In a sophisticated shift of tactics, the Chinese espionage group known as Fire Ant has moved away from targeting VMware hypervisors to compromising Cisco routers, TACACS authentication servers, and Linux management hosts. This discovery was made by the incident response firm Sygnia.
The breach was identified after researchers found an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router. This interface was completely invisible in the running configuration and commit history, indicating a deep-level compromise of the operating system. The malware was designed to be stealthy, suppressing syslog messages to hide tunnel-related activity from network administrators.
BozokMedia analysis shows that by compromising the router, the attackers have effectively neutralized the 'trusted' nature of the network path. When a transit device becomes a collection platform, every packet of data passing through it—including authentication flows and administrative credentials—is potentially exposed. This represents a catastrophic failure of the perimeter security model.
"Once the actor controlled the router, the device became a vantage point for observing traffic moving through trusted network paths."
The attackers leveraged their administrative access to capture network traffic and upload PCAP files to external FTP servers. This allows the threat actor to map internal topologies and identify high-value targets within connected networks, such as critical infrastructure systems, by probing ports used for SSH, RDP, and SMB/RPC.
Furthermore, Sygnia uncovered a previously undocumented backdoor dubbed 'BridgeAgent.' Disguised as a legitimate Zabbix monitoring agent, this root-level systemd service supports TLS reverse shells, allowing the attackers to maintain persistence and execute additional payloads on the compromised host.
While the activity strongly overlaps with UNC3886 (a Chinese group previously documented by Google), Sygnia noted slight differences in implementation and file paths. The group is also known to manipulate file timestamps to deceive forensic investigators.
Q1: What is the 'target behind the target' tactic?
A: It is a strategy where attackers compromise a trusted intermediate device (like a router) to use it as a covert bridge to reach a more sensitive, high-value target network that is otherwise inaccessible.
Q2: How did the malware avoid detection by administrators?
A: The malware selectively suppressed syslog messages and operated on an alternating hourly schedule, ensuring that its activity didn't create obvious spikes or logs during peak monitoring times.
