Threat reportAPTTL-2026-4123
Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco IOS XR routers, TACACS+ servers and Linux management hosts with BridgeAgent and TacTap
Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco (TL-2026-4123), also tracked as Fire Ant, is a high-severity advanced persistent threat campaign, first published 2026-10-22. It is attributed to Mustang Panda - G0129 (China) with medium confidence, affects Cisco IOS XR routers, maps to 16 MITRE ATT&CK techniques (T1014, T1036.005, T1040), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 1Mustang Panda - G0129
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-4123
- Threat ID
- TL-2026-4123
- Also known as
- Fire Ant, BridgeAgent, TacTap
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Mustang Panda - G0129
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- critical infrastructure, large enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco
Malware and tooling: BridgeAgent, Nexus, TacTap
How Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco works
Sygnia reports that the China-nexus espionage actor Fire Ant has moved from VMware hypervisors to the trusted infrastructure that routes, authenticates and manages high-value networks: Cisco IOS XR routers, TACACS+ (tac_plus) servers and Linux management hosts. The actor uses BridgeAgent (a zabbix_agent.service-masquerading backdoor), TacTap (a tac_plus library-injection credential collector), Medusa/REPTILE-style rootkits and router-side log suppression to keep long-lived, hard-to-see access.
Sygnia's investigation (blog dated 27 August 2026, press release 30 August 2026) began with an anomalous GRE tunnel interface on a Cisco IOS XR router that had no running configuration or commit history. Tracing it led to a legacy Linux system, then to port probing and connection attempts against SSH, HTTP, SMB and RDP, and finally to credential harvesting and log suppression across routers, TACACS+ servers and Linux jump hosts. Sygnia describes a 'target behind the target' model in which the compromised infrastructure gives reach into connected third-party environments, including critical infrastructure that relies on shared routing, authentication and management relationships. The initial access vector is not identified in the source and no CVE is attributed to this activity.
Cisco IOS XR: the actor deployed an implant at /usr/bin/acpid and used a masqueraded boot script, /etc/rc.d/init.d/grub-rommon, for persistence, with execution scheduled in odd-numbered hours. Additional components include /pkg/bin/dhcpd_show_issu_status (Telnet C2 component) and /pkg/bin/hd (command-output manipulation). A modified IOS XR syslog library conditionally suppresses log delivery based on string matching ('Health'). The actor suppressed SNMP traps and AAA requests, and made the router CLI append '| exclude' filters to show commands so the GRE tunnel stayed hidden. PCAPs captured from multiple Cisco devices were uploaded to external FTP servers prepared the same day.
TACACS+ servers: TacTap is a multi-component credential collector. The injector /usr/sbin/acppid injects /lib/libseconfd.so into the running tac_plus process, which hooks accept and accept4 to intercept accepted sessions. A UNIX socket at /var/run/acpid.lock is used for file-descriptor handoff. Captured credentials are written to /var/log/.tacplus.acct, obfuscated with single-byte XOR 0xEF. Sygnia states this tac_plus library-injection technique has not been publicly described before.
Linux management hosts: BridgeAgent persists through a root-level zabbix_agent.service systemd unit with automatic restart, disguises its process as /usr/bin/gnome-shell, keeps an encrypted configuration at /opt/.ICEauthority, and provides command execution and an outbound TLS reverse shell over port 443. Other tooling includes the Medusa rootkit (working directory /usr/lib/locate/), REPTILE-like binaries masquerading as SentinelOne and Cybereason agent paths and run deleted-but-running, custom SSH backdoors named cupsdd and smartdd (imitating cupsd and smartd), a VMCI/VSOCK backdoor at /var/tmp/audit, and a packet-triggered backdoor at /var/tmp/ping that watches TCP 443/541/8443/10443 and UDP 40443->500 for the magic string sxcdewqaz!@#. Defense evasion includes disabling SELinux, modifying firewall/iptables NAT rules, rewriting IP addresses in wtmp/utmp/btmp with sed, deleting sudo entries from /var/log/messages and /var/log/secure, and HISTFILE suppression. SSH credentials were harvested to /var/log/remote.txt.
Attribution: Sygnia assesses Fire Ant as overlapping with UNC3886 (Mandiant), which focuses on virtualization, edge devices and network infrastructure. Public reporting links the same operating model to TACACS+ credential theft, Medusa rootkit use, VMCI backdoors and router compromise. File names and paths changed after the 2025 exposure, but the operating model stayed the same. Fire Ant's 2025 activity (reported July 2025) exploited VMware vCenter CVE-2023-34048 and ESXi/Tools CVE-2023-20867 and used VIRTUALPITA-aligned backdoors; those CVEs belong to the earlier campaign and are not attributed to the 2026 router/TACACS activity. Sygnia advises treating routers, hypervisors, TACACS+ servers and Linux management hosts as first-class security and forensic assets, validating telemetry through independent sources (memory, disk, network, authentication, configuration), and assuming credential reuse across backdoored systems. Sygnia published four YARA rules (BridgeAgent, BridgeAgent systemd unit, TacTap libseconfd.so, TacTap acppid).
MITRE ATT&CK techniques used in TL-2026-4123
Defense Evasion
T1014 Rootkit; T1036.005 Match Legitimate Resource Name or Location; T1070.003 Clear Command History; T1070.004 File Deletion; T1070.006 Timestomp
Credential Access
T1040 Network Sniffing; T1056.004 Credential API Hooking
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Collection
Command and Control
T1205 Traffic Signaling; T1572 Protocol Tunneling
Persistence
defense-impairment
T1599 Network Boundary Bridging; T1601.001 Patch System Image; T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs
Affected products and versions in Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco
- Cisco — IOS XR routers
Vulnerable versions: Not specified in source - Open source — tac_plus (TACACS+) servers
Vulnerable versions: Not specified in source - Various — Linux management and jump hosts
Vulnerable versions: Not specified in source
Remediation for Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco
Immediate actions
- Hunt routers for GRE/tunnel interfaces with no configuration or commit history and for config state that diverges from CLI output (unexpected '| exclude' filters on show commands)
- Check TACACS+ servers for tac_plus process injection, /usr/sbin/acppid, /lib/libseconfd.so, /var/log/.tacplus.acct and the /var/run/acpid.lock UNIX socket
- Search Linux management hosts for zabbix_agent.service units that do not point to a genuine Zabbix agent, /usr/lib/locate/ artifacts, deleted-but-running processes and SELinux disabled in /etc/selinux/config
- Block outbound FTP/SCP from routers and alert on PCAP generation on network devices
- Rotate all TACACS+, SSH and administrative credentials, assuming reuse across backdoored systems
Workarounds
- No patch applies: no CVE is attributed to the 2026 router/TACACS+ activity and the initial access vector is not identified in the source
Longer-term hardening
- Treat routers, hypervisors, TACACS+ servers, jump hosts and access appliances as first-class forensic assets with memory, disk and network collection
- Validate telemetry against independent sources because the actor manipulates logs, SNMP traps and CLI output
- Alert on iptables NAT/port-redirect changes and on security-agent-named processes that spawn shells, Python, scp or network tools
- Restrict management-plane access paths and segment legacy Linux hosts from edge routers
- Deploy the Sygnia YARA rules for BridgeAgent and TacTap against Linux hosts and memory images
Timeline of Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco
- Mandiant publicly documented UNC3886 exploiting VMware ESXi/Tools CVE-2023-20867 and deploying VIRTUALPITA-family backdoors (June 2023; exact day approximate). Fire Ant's 2025 campaign reused this CVE, and Sygnia assesses Fire Ant overlaps with UNC3886.
- Broadcom patched VMware vCenter CVE-2023-34048, which UNC3886 reportedly used as a zero-day before the fix (October 2023; exact day not given in source). Fire Ant later exploited it in its 2025 VMware campaign.
- Mandiant reported UNC3886 compromising Juniper routers with custom backdoors and log-tampering tooling (March 2025; exact day approximate), establishing the router-targeting operating model that Sygnia later observed in Fire Ant's Cisco IOS XR activity.
- Sygnia first publicly reported Fire Ant compromising VMware ESXi/vCenter and network appliances (July 2025; exact day not given in source). Medusa rootkit and custom SSH backdoors were first deployed in 2025.
- Sygnia published 'Fire Ant Evolves: From Hypervisors to Trusted Infrastructure', documenting Cisco IOS XR, TACACS+ and Linux management host compromise, with hashes, paths and four YARA rules.
- Sygnia issued a press release announcing the new Fire Ant activity against trusted infrastructure, citing victims among leading organizations worldwide.
- The Hacker News and other outlets reported the findings; coverage notes the tac_plus library-injection technique was not publicly described before.
- The Hacker News coverage noted the overlap with UNC3886 while stating Sygnia does not make a conclusive attribution; the report names no victims, IPs or domains.
- eSecurity Planet, Hackread and TechTimes published follow-on coverage describing router log suppression, GRE-based covert gateways and TACACS+ credential theft.
Sources cited for Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco
- Fire Ant Evolves: From Hypervisors to Trusted Infrastructure
- Sygnia reveals new activity by China-nexus threat actor Fire Ant targeting trusted infrastructure
- China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
- China-Linked Hackers Turn Cisco Routers Into Covert Network Gateways
- China-Nexus Fire Ant Hackers Target Cisco Routers, TACACS Servers for Espionage
- China-Linked Hackers Hacked Cisco Routers, Made Network Logs Untrustworthy
- Fire Ant Exploits VMware Flaw to Compromise ESXi Hosts and vCenter Environments
- Fire Ant Breaches VMware Infrastructure in Advanced Espionage Campaign
- UNC3886
Detection coverage for TL-2026-4123
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4123 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.