Sygnia details Fire Ant activity targeting IOS XR routers, TACACS and Linux management hosts

Trusted infrastructure was the objective

Sygnia reported on August 30 that the China-nexus activity cluster it tracks as Fire Ant had expanded beyond its earlier focus on VMware environments into infrastructure that routes traffic, authenticates administrators and supports day-to-day network operations. Its investigation covered Cisco IOS XR routers, TACACS authentication infrastructure and Linux management hosts. Sygnia assesses strong overlap with publicly reported UNC3886 activity, but does not make a conclusive attribution. ([sygnia.co](https://www.sygnia.co/?comeet_all=&comeet_cat=&rd=))

For installers, integrators and enterprise network operators, the important point is architectural: routers, AAA servers and jump hosts are not merely support systems. They are high-privilege control points with visibility into administrative workflows and connectivity between environments. Compromise of that layer can also undermine the records used to determine what happened during an incident. ([sygnia.co](https://www.sygnia.co/?comeet_all=&comeet_cat=&rd=))

Routers were used for reach, collection and concealment

The investigation began after Sygnia identified an active GRE tunnel on a Cisco IOS XR router that was not accounted for in the running configuration or commit history. Sygnia reported that custom IOS XR implants supported covert connectivity, packet collection and changes intended to suppress or filter evidence, including logging and command output. The firm did not identify how the actor initially accessed the router. ([sygnia.co](https://www.sygnia.co/?comeet_all=&comeet_cat=&rd=))

Sygnia traced the tunnel to a legacy Linux system, where it observed connection attempts and port probing toward connected high-value environments. That activity is significant, but it should not be read as confirmation that every probed environment was compromised. Sygnia describes the observed activity as exploration of possible paths beyond the directly affected environment. ([sygnia.co](https://www.sygnia.co/?comeet_all=&comeet_cat=&rd=))

TACACS compromise puts administrative trust at risk

On a TACACS server, Sygnia identified a credential-collection toolset it calls TacTap. According to the report, an injector named acppid placed a malicious library into the running tac_plus process. The library intercepted accepted connections and passed file descriptors over a local Unix socket; investigators also recovered an XOR-obfuscated file containing TACACS-related credential material. ([sygnia.co](https://www.sygnia.co/?comeet_all=&comeet_cat=&rd=))

This changes the response priority for network teams. If the AAA layer may be compromised, its authentication and accounting records cannot automatically be treated as authoritative, and credentials used through that service may require a controlled replacement and rotation plan. Cisco’s IOS XR hardening guidance recommends redundant AAA, AAA logging, centralized log collection and secure transport for both management and logging traffic. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/resources/Cisco-IOS-XR-HardeningGuide?utm_source=openai))

Harden the management path, not just the router

A practical first step is to inventory every management-plane dependency: routers and switches, TACACS or RADIUS servers, jump hosts, network-management platforms, monitoring agents, configuration backup systems and telemetry collectors. Document which administrator accounts, automation identities, shared secrets, SSH keys and management VRFs connect those assets. Establish a reviewed configuration baseline for tunnels, routing policy, management ACLs, system services and expected outbound paths.

Management connectivity should be segregated from ordinary production and peering traffic, with a default-deny approach that permits only approved management stations and required AAA, logging and telemetry services. CISA specifically recommends keeping management interfaces from leaking into customer or peering VRFs, restricting management-VRF egress to authorized collectors, auditing boundary-crossing tunnels and applying explicit management-plane allowlists. ([cisa.gov](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a?utm_source=openai))

Where the deployed platform and AAA service support it, teams should evaluate TACACS+ over TLS 1.3 and secure syslog transport. Cisco states that IOS XR supports TACACS+ over TLS beginning with IOS XR Release 25.3.1 and recommends remote logging, including TLS-based secure logging where applicable. Compatibility, software release support and fallback access should be tested before production changes. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/resources/Cisco-IOS-XR-HardeningGuide?utm_source=openai))

Detection and incident-response implications

Because Sygnia found manipulation across routers, TACACS and Linux hosts, detection should compare independent evidence sources rather than depend on a device’s local logs alone. Useful checks include reconciling configuration archives and commit history with live tunnel and interface state; reviewing outbound connections from management networks; validating expected service binaries and systemd units on Linux hosts; and correlating AAA accounting with remote syslog, flow telemetry and privileged-session records. ([sygnia.co](https://www.sygnia.co/?comeet_all=&comeet_cat=&rd=))

Organizations that identify relevant indicators or unexplained management-plane behavior should preserve evidence before broad cleanup actions, isolate affected management hosts through a planned process, and engage their incident-response team and applicable vendor support. Avoid a rushed, fleet-wide AAA change that could lock administrators out of network equipment. The immediate goal is to establish a known-clean, controlled administration path and preserve sufficient off-device evidence to scope the intrusion.