Fire Ant Threat Actor Targets Trusted Infrastructure in 2026

The China-nexus threat actor known as Fire Ant has evolved its tactics in 2026, transitioning from targeting VMware hypervisors to compromising trusted infrastructure, including Cisco routers, TACACS authentication servers, and Linux management hosts. This shift allows Fire Ant to collect credentials, traffic, and maintain covert access to high-value environments. The actor's operations involve deploying custom malware, such as the BridgeAgent backdoor, which masquerades as legitimate software, and utilizing GRE tunnels for covert connectivity. Fire Ant's activities have significant implications, as they can affect not only the initially compromised systems but also connected external environments, including critical infrastructure. The threat actor's manipulation of logging and telemetry further complicates detection and response efforts. Sygnia's investigation highlights the need for organizations to reassess their security posture regarding trusted infrastructure. The campaign is ongoing, with Fire Ant actively exploring paths to expand its reach.

Key Points: • Fire Ant has shifted focus from hypervisors to trusted infrastructure like routers and authentication systems. • The actor uses novel tools, including the BridgeAgent backdoor, to maintain covert access and collect data. • Manipulation of logging and telemetry complicates detection, posing a significant risk to connected high-value environments.