"This activity reinforces one of the core observations from the investigation: when a threat actor controls routers, they do not only gain reach. They gain perspective," the firm Sygnia said.
How Fire Ant turned Cisco IOS XR routers into collection platforms
Sygnia's investigation traced a 2026 intrusion that repurposed Cisco IOS XR routers as active intelligence collectors. Investigators began with an anomalous Generic Routing Encapsulation (GRE) tunnel interface on an IOS XR device that had no running configuration or commit history explaining its presence. From that tunnel, the attacker reached a legacy Linux host and began repeated connection attempts and port probing against SSH, HTTP, SMB, and RDP on connected networks.
The router implants were purpose-built for the IOS XR control plane. One component embedded a modified system library that inspected each outgoing log message for the string "Health" and forwarded messages only when that string was present. Another component changed the router command-execution path to append an " | exclude" filter to show commands — a deliberate technique to hide the attacker's tunnel configuration from administrators.
TACACS credential theft: TacTap and the /var/log/.tacplus.acct trail
On TACACS servers Sygnia identified a credential-collection toolset it calls TacTap. An injector named /usr/sbin/acppid loaded a malicious library at lib/libseconfd.so into the running tac_plus authentication process. The injected library hooked connection-accept functions and passed live session handles to a second process over a Unix socket. Captured credentials were written to /var/log/.tacplus.acct and lightly obfuscated with a single-byte XOR key of 0xEF.
Sygnia noted that credential theft from TACACS servers is established tradecraft for this cluster; the firm contrasted TacTap with previously reported techniques, calling the tac_plus library-injection technique "a notable evolution" of the group's TACACS-focused collection methods.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageLinux management hosts, BridgeAgent, and persistent backdoors
Beyond routers and TACACS, the actor deployed Linux implants and a durable access stack. Sygnia recovered a backdoor named BridgeAgent that masqueraded as a Zabbix monitoring agent. It persisted via a zabbix_agent.service systemd unit running as root, disguised itself as /usr/bin/gnome-shell, stored an encrypted configuration at /opt/.ICEauthority, and polled the attacker's infrastructure over TLS on port 443 for commands and reverse shells.
Across management hosts the actor used the open-source Medusa and REPTILE rootkits, custom SSH backdoors, and binaries renamed and timestamped to impersonate SentinelOne and Cybereason endpoint agents. Several components were placed in 2025 and reused for hands-on activity in 2026; at least one backdoor remained running in memory after its file had been deleted.
Data exfiltration, anti-forensics, and other implants
Fire Ant used routers to capture packet captures (PCAPs) from multiple Cisco devices and uploaded those captures to external FTP servers; at least one FTP server appeared to have been installed the same day uploads took place. Sygnia also identified a VMCI backdoor at /var/tmp/audit communicating over VMware Virtual Machine Communication Interface sockets and a packet-triggered backdoor at /var/tmp/ping (triggering on TCP ports 443, 541, 8443, and 10443 and UDP source port 40443 to destination port 500, activated by the stringsxcdewqaz!@#).
The actor actively undermined evidence collection: routers had logging, SNMP traps, and authentication requests suppressed; Linux hosts had SELinux disabled; login-history records were rewritten; and privileged-command entries were removed from system logs.
IoCs, persistence scripts, and reported file hashes
- TacTap injector: /usr/sbin/acppid (SHA1: 36005f5e4398a1c62a2a9271eddfcc1b44b1ad00) and injected library lib/libseconfd.so (955cd45a2f6f226a2fdf44b329af1c8dde90cb38). Credential file: /var/log/.tacplus.acct (XOR key 0xEF).
- BridgeAgent persistence: zabbix_agent.service; encrypted config at /opt/.ICEauthority; C2 over TLS on port 443.
- IOS XR implants: /usr/bin/acpid (be6b27f429324a4af05a310d8ec9635e37c68a94), /pkg/bin/dhcpd_show_issu_status (1682b652a15bde732489f22809b0b7594c228fd3), /pkg/bin/hd (b149fa3a34bd585e7a674a4fd9538437bd06f514), persistence script /etc/rc.d/init.d/grub-rommon.
- VMCI backdoor: /var/tmp/audit (13f0c2a598e3aa63856c032a96b110aed963f0e8).
- Packet-triggered backdoor: /var/tmp/ping (5ba1242050b5b447052b210788a5a25593d6987d).
What this means for technologists, policymakers, and affected operators
- Technologists and security teams: validate telemetry across memory, disk, network, authentication, and configuration evidence rather than relying on a single logging source; search for the specific artifacts and persistence mechanisms Sygnia lists (for example, the modified log-filtering library behavior that only forwards messages containing "Health" and the TacTap injector and library paths).
- Policymakers and regulators: the activity highlights router compromise as a route to broad visibility and credential theft; Sygnia noted parallels to a CISA-led advisory from August 2025 that described packet-collection from routers by a different cluster, underscoring repeated risks at the network edge.
- Affected enterprises and procurement leaders: inventory and attest the integrity of TACACS servers, hypervisors, and jump hosts — Sygnia explicitly recommends treating routers, TACACS servers, hypervisors, and jump hosts as first-class forensic assets.
Sygnia assessed the activity strongly overlaps with public reporting on UNC3886 but did not make a conclusive attribution. Mandiant, which originally documented UNC3886, has said it found no technical overlap between UNC3886 and other clusters named Salt Typhoon and Volt Typhoon. Sygnia also linked the techniques to earlier Fire Ant disclosures from July 2025, when the group was shown exploiting VMware ESXi and vCenter before moving into network and management layers.
The core operational fact is simple and stark: with control of routers an intruder can both reach into trusted paths and erase the traces investigators depend on. Sygnia's final operational recommendation is equally direct — validate logs against memory, disk, network, authentication, and configuration evidence — leaving a concrete challenge for defenders: will organizations begin treating network edge devices and management servers as the primary forensic sources they now must be?
