China-Nexus
Fire Ant Expands From VMware Hypervisors to Cisco IOS XR Routers and TACACS Servers
China-nexus actor Fire Ant has moved beyond VMware ESXi hosts to implant Cisco IOS XR routers and TACACS+ authentication servers, using purpose-built tooling to hijack GRE tunnels, hide commands from admins, and intercept credentials at the network's control plane.