The researchers discovered Fire Ant’s new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history.
According to incident response company Sygnia, the threat actor switched from targeting VMware hypervisors to compromising Cisco routers, TACACS authentication servers, and Linux management hosts.
The researchers discovered Fire Ant’s new tactic after finding on a Cisco IOS XR router an active GRE (Generic Routing Encapsulation) tunnel interface that could not be explained by a running configuration or commit history.
Further analysis revealed that Fire Ant had deployed custom malware on the devices, enabling persistence through a fake system service that ran the implant only during alternating hours.
The malware selectively suppressed syslog messages to hide tunnel-related information from legitimate administrators, established outbound Telnet connections to Fire Ant infrastructure, and supported interactive shell access with no logging.
Source: Sygnia
The attackers also used their administrative access to capture traffic from multiple routers and upload the resulting PCAP files to external FTP servers.
These captures could expose internal topology, administrative connections, authentication flows, routing relationships, and traffic exchanged with connected networks.
“This behavior shifts the router’s role from a transit device to a collection platform,” Sygnia explains.
“Once the actor controlled the router, the device became a vantage point for observing traffic moving through trusted network paths.”
The concealed GRE tunnel connected one compromised router to a legacy Linux server, which Fire Ant used as a staging and reconnaissance system.
From there, the attackers probed systems in connected high-value environments, including systems associated with critical infrastructure, over ports commonly used for SSH, web services, SMB/RPC, and RDP.
Sygnia believes that Fire Ant’s operation aimed to compromise trusted infrastructure at an initial victim and use it as a covert bridge to explore access paths into connected high-value networks, a tactic which they dub “target behind the target.”
.jpg)
Source: Sygnia
The researchers also discovered a previously undocumented backdoor called ‘BridgeAgent,’ which Fire Ant disguised as a legitimate Zabbix monitoring agent.
The backdoor persists as a root-level systemd service and supports TLS reverse shells and the execution of additional payloads on the compromised host.
.jpg)
Source: Sygnia
Sygnia says Fire Ant activity strongly overlaps with UNC3886, a Chinese espionage group previously documented by Google. However, the researchers say that there are differences in filenames, paths, and implementation details.
The researchers warned that Fire Ant systematically tampers with system logs and records, even changing file timestamps to obscure evidence that would benefit investigators, noting that logs retrieved from compromised infrastructure should be validated against other data.
Sygnia’s report shares an extensive list of indicators of compromise (IoCs), along with hunting and YARA rules to detect Fire Ant activity.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
