# Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco IOS XR routers, TACACS+ servers and Linux management hosts with BridgeAgent and TacTap

> Sygnia reports that the China-nexus espionage actor Fire Ant has moved from VMware hypervisors to the trusted infrastructure that routes, authenticates and manages high-value networks: Cisco IOS XR routers, TACACS+ (tac_plus) servers and Linux management hosts. The actor uses BridgeAgent (a zabbix_agent.service-masquerading backdoor), TacTap (a tac_plus library-injection credential collector), Medusa/REPTILE-style rootkits and router-side log suppression to keep long-lived, hard-to-see access.

- **Published:** 2026-10-22T08:07:23Z
- **Last reviewed:** 2026-10-22T08:07:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4123
- **ID:** TL-2026-4123
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Mustang Panda - G0129 (China)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Sygnia's investigation (blog dated 27 August 2026, press release 30 August 2026) began with an anomalous GRE tunnel interface on a Cisco IOS XR router that had no running configuration or commit history. Tracing it led to a legacy Linux system, then to port probing and connection attempts against SSH, HTTP, SMB and RDP, and finally to credential harvesting and log suppression across routers, TACACS+ servers and Linux jump hosts. Sygnia describes a 'target behind the target' model in which the compromised infrastructure gives reach into connected third-party environments, including critical infrastructure that relies on shared routing, authentication and management relationships. The initial access vector is not identified in the source and no CVE is attributed to this activity.

Cisco IOS XR: the actor deployed an implant at /usr/bin/acpid and used a masqueraded boot script, /etc/rc.d/init.d/grub-rommon, for persistence, with execution scheduled in odd-numbered hours. Additional components include /pkg/bin/dhcpd_show_issu_status (Telnet C2 component) and /pkg/bin/hd (command-output manipulation). A modified IOS XR syslog library conditionally suppresses log delivery based on string matching ('Health'). The actor suppressed SNMP traps and AAA requests, and made the router CLI append '| exclude' filters to show commands so the GRE tunnel stayed hidden. PCAPs captured from multiple Cisco devices were uploaded to external FTP servers prepared the same day.

TACACS+ servers: TacTap is a multi-component credential collector. The injector /usr/sbin/acppid injects /lib/libseconfd.so into the running tac_plus process, which hooks accept and accept4 to intercept accepted sessions. A UNIX socket at /var/run/acpid.lock is used for file-descriptor handoff. Captured credentials are written to /var/log/.tacplus.acct, obfuscated with single-byte XOR 0xEF. Sygnia states this tac_plus library-injection technique has not been publicly described before.

Linux management hosts: BridgeAgent persists through a root-level zabbix_agent.service systemd unit with automatic restart, disguises its process as /usr/bin/gnome-shell, keeps an encrypted configuration at /opt/.ICEauthority, and provides command execution and an outbound TLS reverse shell over port 443. Other tooling includes the Medusa rootkit (working directory /usr/lib/locate/), REPTILE-like binaries masquerading as SentinelOne and Cybereason agent paths and run deleted-but-running, custom SSH backdoors named cupsdd and smartdd (imitating cupsd and smartd), a VMCI/VSOCK backdoor at /var/tmp/audit, and a packet-triggered backdoor at /var/tmp/ping that watches TCP 443/541/8443/10443 and UDP 40443->500 for the magic string sxcdewqaz!@#. Defense evasion includes disabling SELinux, modifying firewall/iptables NAT rules, rewriting IP addresses in wtmp/utmp/btmp with sed, deleting sudo entries from /var/log/messages and /var/log/secure, and HISTFILE suppression. SSH credentials were harvested to /var/log/remote.txt.

Attribution: Sygnia assesses Fire Ant as overlapping with UNC3886 (Mandiant), which focuses on virtualization, edge devices and network infrastructure. Public reporting links the same operating model to TACACS+ credential theft, Medusa rootkit use, VMCI backdoors and router compromise. File names and paths changed after the 2025 exposure, but the operating model stayed the same. Fire Ant's 2025 activity (reported July 2025) exploited VMware vCenter CVE-2023-34048 and ESXi/Tools CVE-2023-20867 and used VIRTUALPITA-aligned backdoors; those CVEs belong to the earlier campaign and are not attributed to the 2026 router/TACACS activity. Sygnia advises treating routers, hypervisors, TACACS+ servers and Linux management hosts as first-class security and forensic assets, validating telemetry through independent sources (memory, disk, network, authentication, configuration), and assuming credential reuse across backdoored systems. Sygnia published four YARA rules (BridgeAgent, BridgeAgent systemd unit, TacTap libseconfd.so, TacTap acppid).

## MITRE ATT&CK

- T1543.002 Systemd Service
- T1036.005 Match Legitimate Resource Name or Location
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1685 Disable or Modify Tools
- T1685.006 Clear Linux or Mac System Logs
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1601.001 Patch System Image
- T1599 Network Boundary Bridging
- T1056.004 Credential API Hooking
- T1040 Network Sniffing
- T1074.001 Local Data Staging
- T1572 Protocol Tunneling
- T1205 Traffic Signaling
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

## Sources

- [Fire Ant Evolves: From Hypervisors to Trusted Infrastructure](https://www.sygnia.co/blog/fire-ant-evolves-from-hypervisors-to-trusted-infrastructure/)
- [Sygnia reveals new activity by China-nexus threat actor Fire Ant targeting trusted infrastructure](https://www.sygnia.co/press-release/sygnia-reveals-new-activity-by-china-nexus-threat-actor-fire-ant-targeting-trusted-infrastructure/)
- [China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs](https://thehackernews.com/2026/08/china-linked-fire-ant-hijacks-cisco.html)
- [China-Linked Hackers Turn Cisco Routers Into Covert Network Gateways](https://www.esecurityplanet.com/threats/news-fire-ant-hackers-cisco-ios-xr-routers/)
- [China-Nexus Fire Ant Hackers Target Cisco Routers, TACACS Servers for Espionage](https://hackread.com/china-fire-ant-hackers-cisco-routers-tacacs-espionage/)
- [China-Linked Hackers Hacked Cisco Routers, Made Network Logs Untrustworthy](https://www.techtimes.com/articles/326119/20260901/china-linked-hackers-hacked-cisco-routers-made-network-logs-untrustworthy.htm)
- [Fire Ant Exploits VMware Flaw to Compromise ESXi Hosts and vCenter Environments](https://thehackernews.com/2025/07/fire-ant-exploits-vmware-flaw-to.html)
- [Fire Ant Breaches VMware Infrastructure in Advanced Espionage Campaign](https://www.scworld.com/brief/fire-ant-breaches-vmware-infrastructure-in-advanced-espionage-campaign)
- [UNC3886](https://en.wikipedia.org/wiki/UNC3886)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4123