Chinese Fire Ant Hackers Exploit Cisco Routers for Espionage
Recent investigations have revealed that the Chinese hacking group known as Fire Ant has adopted a new strategy by compromising Cisco routers to facilitate espionage activities. Researchers from incident response firm Sygnia discovered this tactic after identifying an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by the device's running configuration or commit history.
The analysis indicated that Fire Ant had transitioned from targeting VMware hypervisors to focusing on Cisco routers, TACACS authentication servers, and Linux management hosts. This change in approach allows the hackers to deploy custom malware on the compromised devices, ensuring persistence through a fake system service that operates intermittently.
The malware is designed to suppress syslog messages, effectively hiding tunnel-related information from legitimate administrators. It establishes outbound Telnet connections to the Fire Ant infrastructure, enabling interactive shell access without logging. This level of access allows the attackers to capture traffic from multiple routers and upload the resulting packet capture (PCAP) files to external FTP servers.
The implications of this tactic are significant, as the captured data can reveal internal network topology, administrative connections, authentication flows, and routing relationships. Sygnia noted that this behavior transforms the router from a mere transit device into a collection platform for sensitive information.
Once the hackers gain control of a router, it becomes a strategic vantage point for monitoring traffic traversing trusted network paths. The concealed GRE tunnel connects a compromised router to a legacy Linux server, which Fire Ant uses for staging and reconnaissance. This setup allows the attackers to probe systems in high-value environments, including those associated with critical infrastructure, using common ports for SSH, web services, SMB/RPC, and RDP.
Sygnia's report suggests that Fire Ant's operations are aimed at compromising trusted infrastructure at an initial victim and using it as a covert bridge to explore access paths into connected high-value networks, a tactic they refer to as 'target behind the target.'
Additionally, the researchers identified a previously undocumented backdoor named 'BridgeAgent,' disguised as a legitimate Zabbix monitoring agent. This backdoor persists as a root-level systemd service and supports TLS reverse shells and the execution of additional payloads on the compromised host.
While there are overlaps between Fire Ant's activities and those of the Chinese espionage group UNC3886, researchers noted differences in filenames, paths, and implementation details. They also warned that Fire Ant systematically alters system logs and records, even changing file timestamps to obscure evidence that could aid investigators. Therefore, logs retrieved from compromised infrastructure should be validated against other data sources.
Sygnia's report includes a comprehensive list of indicators of compromise (IoCs) and detection rules to help identify Fire Ant activity. The findings highlight the challenges of cybersecurity, particularly as attackers leverage valid credentials to bypass prevention measures, underscoring the need for robust defenses against such sophisticated threats.
