How Fire Ant Turned Trusted Network Infrastructure Into an Espionage Platform

Fire Ant’s reported campaign shows a strategic move up the infrastructure stack. In 2025, the China-linked actor was associated with stealthy access to VMware ESXi and vCenter environments. By late August 2026, reporting described compromises of Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts—the systems that route traffic, validate administrators, and connect operational environments. 1011

That progression matters because these systems can provide visibility and access far beyond a single virtual machine or endpoint. The immediate victim may be only the first position in a broader operation: the “target behind the target.”

From hypervisors to the control plane

Fire Ant’s earlier VMware activity focused on virtualization infrastructure that could provide persistence and access across hosted workloads. Sygnia’s later reporting describes a campaign centered on trusted infrastructure: network devices, authentication services, and management hosts. 10

This is a more powerful collection point. A compromised router can observe and relay traffic. A compromised TACACS server sits in the administrative authentication path. A compromised jump or management host can provide a bridge between otherwise separated systems. Together, those footholds can expose relationships among administrators, devices, networks, and connected organizations. 1011

How the operation worked

An unexplained GRE interface provided a possible pivot

Investigators found an active GRE interface on a Cisco IOS XR router that could not be explained by the running configuration or commit history. GRE normally encapsulates one protocol inside an outer IP packet between tunnel endpoints, so an unauthorized tunnel can create a concealed route or relay path. 39

The discrepancy was significant not because every unexplained tunnel proves compromise, but because the live device state did not match the normal audit trail. That can indicate activity occurring outside expected configuration workflows and should trigger immediate investigation.

BridgeAgent disguised persistence as monitoring software

On a legacy Linux management system, Fire Ant deployed BridgeAgent while presenting it as a Zabbix monitoring agent. The implant reportedly supported TLS-encrypted reverse-shell communications, allowing operators to maintain access through traffic that could resemble legitimate management activity. 1012

A management host is especially valuable as a pivot. It may already be trusted to reach routers, authentication services, monitoring systems, or other restricted segments.

The router became a collection and relay platform

The compromised IOS XR router could be used to capture traffic, stage packet captures, and exfiltrate PCAP data. Router-level observation can reveal communicating systems, protocols, address ranges, routing relationships, and—when traffic is not adequately protected—sensitive data or credentials. 1011

The router therefore served more than a persistence function. It became a vantage point inside the network’s connective tissue, offering both intelligence and reachability while potentially blending malicious activity with ordinary network operations.

TacTap targeted the authentication chokepoint

Fire Ant also compromised TACACS infrastructure rather than relying only on credentials stolen from individual endpoints. Sygnia described a toolkit called TacTap that injected a library into the tac_plus process, hooked accepted TACACS sessions, and passed live session file descriptors to a local Unix socket. It also created an XOR-obfuscated credential artifact at /var/log/.tacplus.acct. 10

A TACACS server can expose the administrative path for network devices: which administrators authenticate, which devices request authorization, when sessions occur, and potentially credential material handled by the service. Compromise at this layer can undermine both access control and confidence in the resulting audit trail.

Additional backdoors extended the campaign’s virtualization-aware tradecraft

Investigators identified a /var/tmp/audit backdoor on the TACACS system that used VMware VSOCK/VMCI interfaces. These guest–host-oriented channels may not appear as ordinary network logins from within the Linux guest, giving operators another covert communications option. 10

The technique also connects the newer activity conceptually to Fire Ant’s earlier interest in virtualization-adjacent infrastructure: the actor continued to look for trusted system boundaries that conventional endpoint monitoring might not fully cover.

Log suppression and timestamp changes weakened the evidence layer

Fire Ant reportedly suppressed logging and telemetry and modified file timestamps. Those actions make it harder to reconstruct when tools, tunnels, persistence mechanisms, and credential artifacts appeared. They also reduce confidence in the router and authentication records defenders would normally use to establish scope and sequence. 1011

This is an important part of the campaign, not an afterthought. By attacking the evidence layer, the actor made both detection and incident response less reliable.

What the actor could expose

The combined footholds could help Fire Ant map and exploit the relationships that make a network manageable:

• Administrator identities and privileged network-device credentials.
• Authentication requests, authorization decisions, device sessions, and administrative activity.
• The links among jump hosts, TACACS servers, routers, and managed devices.
• Internal address ranges, routing relationships, segmentation boundaries, and reachable management networks.
• Connected organizations or third parties whose environments depend on the compromised infrastructure.
• High-value networks that can be reached through the victim’s routing, authentication, or operational-management relationships. 10

The risk is cumulative. A hypervisor foothold, a Linux management implant, a router tunnel, and access to TACACS may each look like a separate incident. Together, they can form a durable access layer across multiple trust boundaries.

Why this is called a “target behind the target” strategy

In a conventional intrusion, the compromised organization is often the primary objective. Fire Ant’s reported behavior suggests another possibility: the victim’s infrastructure may be valuable because it provides a route to other environments.

A router can provide transit and visibility. An authentication server can reveal or intercept administrative access. A management host can supply a trusted launch point. This allows an actor to study connected networks and identify higher-value targets without immediately attacking them directly. Sygnia described the campaign as targeting infrastructure that routes, authenticates, connects, and manages high-value environments. 1011

That model is particularly difficult to contain because the affected systems are often treated as trusted foundations rather than ordinary endpoints.

How the activity overlaps with UNC3886

Sygnia has described strong overlap between Fire Ant and the China-linked activity tracked by Mandiant as UNC3886. The overlap includes persistent access to virtualization and network-control infrastructure, custom tooling, evasion of conventional endpoint visibility, and interest in networking equipment. Public reporting also links UNC3886 to earlier activity involving Juniper routers and Cisco-oriented infrastructure. 1015

The available reporting supports an operational and tooling correlation, not necessarily a publicly proven one-to-one identity. The more durable connection is the operating model: maintain access at the infrastructure layer, where devices may have limited endpoint telemetry and where compromise can influence routing, administration, identity validation, or segmentation.

Why critical infrastructure operators should care

The cited reporting does not establish that this specific Fire Ant activity directly compromised a water or wastewater utility. The broader concern is that long-lived access to enterprise, service-provider, or management infrastructure could provide observation or potential paths toward connected critical environments. Sygnia’s reporting explicitly discusses high-value and critical-infrastructure concerns. 110

For water and wastewater organizations, the lesson is not to assume that an isolated operational network is safe simply because its business systems appear untouched. Shared identity services, remote administration, third-party connections, virtualization platforms, and network-management infrastructure can create indirect trust paths. The practical risk comes from accumulated footholds rather than from one spectacular exploit.

Defensive priorities for network-management infrastructure

Treat management systems as Tier 0

Give routers, TACACS/RADIUS and other AAA services, jump hosts, virtualization management, and monitoring platforms dedicated ownership and protection. Apply strict administrative boundaries, MFA where supported, least privilege, rapid patching, and tightly controlled vendor and third-party access. 10

Reconcile live device state with approved changes

Continuously compare router interfaces, tunnels, routes, forwarding state, configuration commits, and software or process integrity with approved baselines. Alert on GRE interfaces, tunnel endpoints, or route changes that lack an authorized change record. 910

Segment administrative paths

Limit device administration and TACACS access to dedicated management networks. Restrict which jump hosts can reach network devices, and minimize trust paths between enterprise IT, service-provider links, and operational or critical environments. 10

Make authentication telemetry tamper-resistant

Forward TACACS, router, Linux, hypervisor, and network-flow logs to off-host storage that is immutable or otherwise resistant to tampering. Correlate authentication requests, authorization outcomes, device sessions, and administrative commands. Investigate missing telemetry and unexpected changes to TACACS processes, libraries, sockets, or log files. 10

Preserve evidence before remediation

If compromise is suspected, collect volatile state and memory where feasible, router operational data, full configurations and commit history, process and socket information, filesystem metadata, and relevant PCAPs before restarting devices or deleting artifacts. Preserve independent copies and hashes, especially when the suspected activity includes log suppression or timestamp manipulation. 10

Hunt for behavior, not just filenames

Look for unauthorized monitoring-agent binaries, suspicious TLS reverse connections from management hosts, unexpected VSOCK/VMCI use, TACACS process injection, hidden credential artifacts, and mismatches between live device state and approved configuration history. These behavioral signals are more durable than any single filename or indicator. 10

The central lesson

Fire Ant’s evolution is best understood as a shift from compromising workloads to compromising the systems that govern trust. The campaign’s reported combination of router visibility, authentication interception, Linux persistence, covert tunnels, and anti-forensics could turn trusted infrastructure into a platform for intelligence collection and movement toward connected environments.

For defenders, the priority is equally clear: network-management infrastructure is not background plumbing. It is a security boundary, a high-value source of evidence, and potentially the path to the next target.