cybercrime.clubhttps://cybercrime.club/tags/china-nexus/Infrastructure security news for people who build infrastructure.Hugo -- gohugo.ioen-usTue, 01 Sep 2026 11:12:06 -0400Fire Ant Expands From VMware Hypervisors to Cisco IOS XR Routers and TACACS Servershttps://cybercrime.club/posts/fire-ant-china-cisco-ios-xr-tacacs-router-implants/Tue, 01 Sep 2026 11:12:06 -0400https://cybercrime.club/posts/fire-ant-china-cisco-ios-xr-tacacs-router-implants/China-nexus actor Fire Ant has moved beyond VMware ESXi hosts to implant Cisco IOS XR routers and TACACS+ authentication servers, using purpose-built tooling to hijack GRE tunnels, hide commands from admins, and intercept credentials at the network's control plane.vulnerabilities