Fire Ant: Cisco IOS XR, TACACS, and Linux Management Infrastructure Hijacked into Spying and Access Platforms
1. Overview Title : Chinese Fire Ant hackers turn Cisco routers into spying platforms Publisher : BleepingComputer Publication Date : 2026-08-31 Original Source : BleepingComputer Related Sources : Sygnia Related Malware, Threat Groups, CVEs, Products : Fire Ant, BridgeAgent, TacTap, Medusa rootkit, Cisco IOS XR, TACACS+, Linux, Zabbix Severity : High 2. Executive Summary Fire Ant compromised…
Chinese hackers called Fire Ant infiltrated Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. They exploited these systems to gather intelligence on connected high-value networks. The attackers placed hidden scripts and components on the routers and Linux hosts, manipulated network traffic, and stole credentials to move laterally within the targeted networks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
