Fire Ant Targets Network Core: Cisco IOS XR and TACACS Servers Subverted for Covert Espionage
China-nexus espionage group Fire Ant has shifted its focus from hypervisors to core control-plane infrastructure, compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. According to an investigation by Sygnia, the threat actor modified the underlying execution environments of Cisco IOS XR devices to establish persistence, anti-forensic capabilities, and covert communication channels. On affected routers, investigators discovered an active GRE tunnel interface that was missing from running configurations and commit-history records. The intrusion toolkit utilized a rogue persistence script disguised as a boot service alongside an implant named `acpid` that executed intermittently to minimize runtime visibility. The attackers deployed a modified IOS XR syslog library designed to intercept and suppress any log events containing the string "Health", returning fake success statuses rather than alerting administrators. To further mislead network engineers, the malware hooked the CLI command-execution path to append hidden exclusion filters to `show` commands, hiding all trace of malicious VRFs, interfaces, and tunnel configurations. The group abused administrative workflows to perform packet captures across router interfaces, staging and exfiltrating PCAP dumps to external FTP servers to map topology and capture credentials. Concurrently, Fire Ant attacked TACACS servers using a modular toolset tracked as TacTap, which injected a rogue shared library at `/lib/libseconfd.so` via `/usr/sbin/acppid` directly into the `tac_plus` daemon. TacTap hooked the `accept` and `accept4` socket APIs to capture live administrator sessions and credential material, writing the data to `/var/log/.tacplus.acct` obfuscated with a single-byte XOR key (`0xEF`). Additionally, the actors maintained a Linux staging node utilizing a root backdoor dubbed BridgeAgent, which masqueraded as a `zabbix_agent.service` systemd unit and disguised its process name as `/usr/bin/gnome-shell` while probing downstream critical infrastructure targets.
Commentary
This campaign highlights a sophisticated trend in state-sponsored tradecraft: subverting the very tools operators trust to inspect their environment. By hooking system libraries within Cisco IOS XR and modifying the output of standard administrative `show` commands, the attackers turn the local CLI into an unreliable source of truth. When the control plane itself is compromised, standard administrative workflows like running interface checks or relying on syslog streams will actively lie to incident responders. The abuse of the TACACS+ daemon (`tac_plus`) via runtime library injection (`/lib/libseconfd.so`) is particularly damaging because it bypasses protocol encryption at the application boundary. By hooking `accept()` and `accept4()`, the malware intercepts plain-text credentials during active administrator authentication before the daemon processes the request, effectively providing the adversary continuous administrative access across every downstream device authenticated by that server. Organizations operating Cisco IOS XR or centralized TACACS architectures need to rethink monitoring assumptions. Trusting local device outputs is insufficient when the runtime environment is modified; integrity verification must occur out-of-band. Network teams should implement cryptographic image verification (e.g., verifying digital signatures via hardware root-of-trust where available), monitor process memory on Linux-based management nodes for unauthorized hooks on `tac_plus`, and compare external network flow data (NetFlow/IPFIX) against internal routing tables to spot ghost interfaces like untracked GRE tunnels.
The Quote to Remember
“the campaign demonstrates how attackers can weaponize the systems that route traffic, validate administrator access, and preserve security telemetry to reach connected high-value and critical-infrastructure environments.”