Fire Ant Expands Cyber Espionage Tactics to Compromise Cisco Routers
A cyber espionage actor known as Fire Ant, linked to China, has extended its long-running campaign to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts. This expansion follows previous activities targeting VMware hypervisors and indicates a shift towards high-value network infrastructure.
Sygnia, an incident response firm, reported that the compromised routers have been repurposed into platforms for collecting sensitive network traffic and credentials. The group has also suppressed logging and telemetry data, which are essential for security teams to analyze and respond to attacks. The investigation revealed that while Fire Ant has explored connections to critical infrastructure, confirmed compromises in those areas have not been reported, with activity limited to scanning and connection attempts.
The ability to control routers provides Fire Ant with a strategic advantage, allowing them to monitor traffic traversing trusted network paths. Sygnia emphasized that when threat actors gain control over routers, they not only extend their reach but also enhance their perspective on network activities.
The group's activities have been associated with UNC3886, a known China-linked espionage group that has previously targeted virtualization platforms and network edge devices. However, Sygnia noted that it could not definitively attribute the activities to this group.
The investigation began with an anomaly detected on a Cisco IOS XR router, where a Generic Routing Encapsulation (GRE) tunnel interface was found operating without a configuration history. Tracing this tunnel led investigators to a legacy Linux system, which Fire Ant used to conduct repeated connection attempts against various administrative and service ports.
Fire Ant's malware was specifically designed for the IOS XR control plane, featuring components that manipulated log messages and concealed the attacker's configurations from network administrators. The group also captured packet data from multiple Cisco devices, which was then uploaded to external FTP servers.
On the TACACS server, a credential-collection toolset identified as TacTap was discovered. This tool injected malicious libraries into the tac_plus authentication process, allowing the group to capture live session credentials. The captured data was obfuscated to evade detection.
Additionally, Sygnia identified a new Linux backdoor named BridgeAgent, which masqueraded as a Zabbix monitoring agent and maintained persistent access to the compromised systems. The backdoor was designed to communicate with the attacker's infrastructure over secure channels.
Fire Ant's operations included efforts to erase evidence of their activities by suppressing logs and altering system records. Sygnia advised that routers, TACACS servers, and other critical components should be treated as vital forensic assets during investigations, emphasizing the need for comprehensive validation of logs against multiple sources of evidence.
The report also highlighted parallels between Fire Ant's activities and those attributed to another Chinese espionage group, Salt Typhoon, which has been known to capture packet data from compromised routers. Sygnia's findings underscore the evolving tactics of cyber espionage actors and the importance of robust security measures to protect critical infrastructure.
