Incident response firm Sygnia has published new findings on Fire Ant, a China-nexus espionage actor previously known for compromising VMware ESXi hosts to pivot into isolated segments of victim networks. The latest activity shows the group has moved up the stack: it is now directly implanting Cisco IOS XR routers, TACACS+ authentication servers, and the Linux management hosts that operators use to administer high-value network infrastructure. The campaign targets the control plane itself — the routing, authentication, and administrative layer that most security tooling assumes is trusted.

How the intrusion was found

Sygnia’s investigation began after analysts spotted a GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that had no corresponding entry in the running configuration or commit history — a router with a route that officially did not exist. Pulling that thread led to two previously undocumented tools.

BridgeAgent: masquerading as monitoring infrastructure

The first, tracked as BridgeAgent, is a Linux implant that hides in plain sight by mimicking legitimate monitoring software. It persists via a zabbix_agent.service systemd unit configured to run as root with automatic restart, so it survives reboots and looks, at a glance, like an ordinary Zabbix agent. Once running, BridgeAgent rewrites its own process command line to display as /usr/bin/gnome-shell in process listings, defeating quick ps/top triage. It loads an encrypted configuration blob from /opt/.ICEauthority — a path chosen to blend in with desktop-session cruft rather than draw attention — and periodically polls an actor-controlled server over HTTPS on port 443 for tasking, giving the operators a low-noise C2 channel that looks like routine outbound web traffic.

TacTap: intercepting TACACS+ sessions in memory

The second tool, TacTap, targets the TACACS+ daemon (tac_plus) that many enterprises use to centralize authentication and command authorization for network devices. TacTap consists of an injector binary (/usr/sbin/acppid) that loads a malicious shared library (/lib/libseconfd.so) directly into the running tac_plus process. Once injected, it hooks the accept and accept4 libc functions, placing itself directly in the live TCP session-handling path so it intercepts every newly accepted administrative connection before the daemon itself sees it. Captured credentials are written to /var/log/.tacplus.acct, obfuscated with a single-byte XOR key (0xEF) to slip past casual inspection and simple string-matching detections. Because TACACS+ is the system that decides which administrators can log into which routers and switches, compromising it gives Fire Ant a durable feed of the credentials needed to move laterally across every device the server manages.

Hiding from the people who run the routers

On the IOS XR routers themselves, Sygnia found a component that altered the router’s command-execution path to silently append an | exclude filter to show commands, so any output containing the attacker’s tunnel configuration is stripped before it reaches the screen of an administrator running routine diagnostics. A second component patched the router’s logging library to inspect each outgoing syslog message for the literal string “Health” and forward only messages that matched — effectively blinding the router’s telemetry to everything the attackers did while leaving harmless heartbeat-style messages flowing, so log pipelines don’t show an obvious gap.

Why this matters

This is not a commodity Linux backdoor ported to routers — the tooling was purpose-built for the IOS XR control plane and for the specific internals of tac_plus, which means the operators had done real reverse-engineering work against Cisco’s platform and a widely deployed AAA daemon before writing code. Compromising the authentication and routing layer rather than an application server gives an actor visibility into credentials and traffic for every downstream system, while defeating the exact tools (syslog, show command output) defenders normally trust to detect an intrusion. Sygnia notes the campaign targets “trusted infrastructure” broadly — network gear, jump hosts, and AAA servers that typically sit outside EDR coverage and get far less scrutiny than endpoints or cloud workloads.

Mitigation

There is no CVE here; this is abuse of legitimate administrative access following initial compromise, not a single patchable flaw. Sygnia’s priority recommendations:

  • Isolate the management plane. Administrative interfaces for routers, switches, and TACACS+ servers should sit on a dedicated, tightly access-controlled network segment, not reachable from general enterprise or internet-facing segments.
  • Restrict outbound connectivity from network infrastructure. Routers and AAA servers have no legitimate reason to make arbitrary outbound HTTPS calls; egress-filter management-plane hosts and alert on unexpected TLS connections from them.
  • Audit for unexplained GRE tunnels and other config drift. Compare running configuration against commit history and known-good baselines regularly; a tunnel interface with no corresponding commit is a strong indicator of tampering.
  • Integrity-check TACACS+ and other AAA daemons. Verify tac_plus and its loaded libraries against known-good hashes; unexpected shared libraries loaded into an authentication daemon’s process space warrant immediate investigation.
  • Treat compromised network gear as unrecoverable in place. Reimage affected routers and Linux management hosts from known-good images and rotate all credentials that transited the compromised TACACS+ server, rather than attempting to clean an implant off a live device.
  • Hunt for the specific indicators. Sygnia’s report includes file hashes for acppid and libseconfd.so, the /opt/.ICEauthority and /var/log/.tacplus.acct paths, and the zabbix_agent.service persistence mechanism — all worth a one-time sweep even outside a known incident.

References