Fire Ant compromised Cisco routers and TACACS servers, stole admin credentials, and rewrote logs to hide

When an intruder controls the router, the authentication server, and the management host, the telemetry those devices produce stops being evidence. It becomes whatever the intruder decides to show you. That is the uncomfortable center of the latest report from incident-response firm Sygnia on a China-nexus espionage group it tracks as Fire Ant, which has graduated from compromising VMware hypervisors to living inside the Cisco IOS XR routers, TACACS authentication servers, and Linux hosts that route, authenticate, and manage high-value networks.

The espionage itself is not the interesting part. Nation-state groups steal credentials every day. What separates this campaign is how much of the effort went into making the compromise invisible to the people who own the network, by rewriting the logs, forging the login history, and impersonating the very security agents defenders trust. If your detection strategy assumes the box tells the truth about itself, this is the campaign built to beat you.

The entry point is unknown, which is the first lesson

Sygnia did not attribute the initial access to a specific CVE, and there is no patch to point at. Investigators found the intrusion the hard way: a Generic Routing Encapsulation (GRE) tunnel interface running on a router with no matching configuration and no commit history. The device's live state no longer matched the configuration and audit records its administrators could see. That mismatch is the whole story in one observation. You cannot wait for a vendor advisory when the entry vector is undisclosed. You detect the aftermath, or you do not detect it at all.

Credential theft moved into the authentication daemon

On the TACACS servers, Fire Ant ran a toolset Sygnia named TacTap. Its injector, a binary at /usr/sbin/acppid, slipped a rogue library into the live tac_plus process and skimmed administrator credentials the moment operators signed in. Each captured login landed in a hidden file, /var/log/.tacplus.acct, lightly scrambled with a one-byte XOR (key 0xEF) so a casual look would miss it. Sygnia said it had not seen this particular way of hooking tac_plus written up anywhere public before.

Here is the part the wire coverage underplays. A TACACS server is not a supporting service. It is the machine that mints valid administrative credentials for every device that trusts it. Compromise it and you do not steal one login, you steal the keys to the fleet. Most organizations treat TACACS as network plumbing and monitor it accordingly, which is to say barely. It deserves the isolation and scrutiny you give a domain controller, because in a network context that is exactly what it is.

Blinding the logs, not deleting them

The log manipulation is the sharpest tradecraft in the report, and it inverts how most defenders think about log tampering. Normal suppression matches known-bad events and drops them. Fire Ant did the opposite. Its tampered router libraries inspected each log line on the way out, kept only the ones carrying the word Health, and threw the rest away, wrapping the delivery path so a message was judged before it ever reached mq_send. A boot service that ran only on odd-numbered hours kept the implant alive. On the command line, the actor rewrote execution paths so that a | exclude filter hid the rogue tunnel from any administrator who went looking.

Think about what that allowlist does to a monitoring dashboard. Heartbeat and health messages keep flowing, so any liveness check that asks "are logs still arriving from this router?" answers yes. Meanwhile every event that would reveal the intrusion silently vanishes. The channel looks alive and is functionally blind. The detection that catches this is not "did the logs stop," it is "did the volume and the diversity of event types collapse while the heartbeat kept ticking." That is a different alert, and most shops do not have it.

On the Linux hosts the cover-up was cruder but just as effective: SELinux switched off, the wtmp, utmp, and btmp login records rewritten so genuine router addresses read as internal ones, and every sudo line pulled from the logs so the privilege escalation left no footprint.

Persistence that dresses up as your defenses

Fire Ant did not just hide. It wore the defenders' uniform. Sygnia calls the Linux backdoor BridgeAgent. It held its place through a root-level systemd service disguised under the name zabbix_agent.service, took the process name /usr/bin/gnome-shell, and beaconed over TLS on port 443 with its config encrypted at /opt/.ICEauthority. Layered on top were two rootkits, Medusa and REPTILE, a set of custom SSH backdoors, and the part that should sting: decoy binaries carrying the names of SentinelOne and Cybereason agents. One of those decoys stayed resident in memory even after its file on disk was gone. A separate implant sat dormant until a crafted packet on a set of high ports woke it, then spawned a shell.

The fake endpoint agents are the detail worth internalizing. Once an attacker ships a process that looks like your EDR, process-name trust is dead. A defender who scans for "is SentinelOne running" gets a yes from the impostor. The check that survives this is integrity, not identity: verify the agent binary against a known-good signature and hash, and alert when a second process claims to be an agent that should exist exactly once. We made a version of this argument when Microsoft's own signed driver could be turned against security tools, and again when a Linux backdoor moved into the Windows kernel to hide from on-host scanners. The through-line is the same: anything that lives on the host, including your security stack, is something an attacker who owns the host can imitate or subvert.

Attribution points at UNC3886, without landing

Sygnia found strong overlap between Fire Ant's tooling and prior public reporting on UNC3886, a China-nexus group with a history of hitting virtualization and network-edge gear, while stopping short of a firm attribution. The trigger strings and the packet-handling logic had moved on from what earlier writeups documented. Treat the UNC3886 connection as the informed hypothesis it is, not a settled fact. It matters less who did it than that the tradecraft, infrastructure-layer persistence with methodical anti-forensics, is now documented and will be copied. This is the same infrastructure-abuse pattern we saw when a China-linked group turned a remote-management platform into a ransomware launchpad.

Ship the logs off the box before the box learns to lie

Every cover-up move in this report shares one weakness: it can only touch what is still on the compromised device. The wtmp rewrite, the Health allowlist, the stripped sudo lines, all of it operates on local state. A log entry that was already forwarded, in real time, to a collector the router cannot reach is beyond the attacker's edit. That is why off-host log shipping is not a compliance checkbox here, it is the control that turns this entire campaign visible. Suriq runs managed detection on exactly that principle: collect and retain the telemetry away from the hosts that generate it, so tampering after the fact rewrites a copy that no longer matters. See how we approach log management and retention.

Three concrete detections follow directly from the tradecraft. Put file-integrity monitoring on the authentication daemon libraries and on the systemd unit directory, so a library injected into tac_plus or a rogue zabbix_agent.service raises a flag the moment it lands. Alert on a collapse in log volume or event-type diversity from network devices, not just on total silence, because the heartbeat is designed to keep the silence alarm quiet. And cross-check device configuration against a known-good baseline out of band, since the whole GRE-tunnel discovery came down to live state not matching the audit record. That last one is ordinary threat hunting, and on this campaign it is what worked.