China-Nexus Threat Actor Fire Ant Targets Critical Infrastructure

Sygnia has reported ongoing espionage activities by a China-nexus threat actor known as Fire Ant, which exploits routers, authentication systems, and Linux management hosts to gather intelligence and access high-value environments. The threat actor targets Cisco IOS XR routers, using them to suppress evidence of their activities and collect sensitive data. This campaign marks an evolution from Fire Ant's previous focus on virtualization infrastructure in 2025, now extending to strategic infrastructure abuse. Key findings indicate that compromised routers and TACACS servers were used to intercept administrative authentication flows and collect credentials. New attack tools identified include BridgeAgent, a masquerading implant, and TacTap, a credential-collection toolset. The implications of this activity extend beyond the immediate victims, potentially impacting interconnected environments. Sygnia emphasizes the importance of addressing these vulnerabilities to prevent broader exploitation.

Key Points: • Fire Ant targets critical infrastructure for espionage, leveraging novel attack tools. • Compromised Cisco IOS XR routers enable traffic collection and credential interception. • The campaign signifies a shift from virtualization to strategic infrastructure abuse.