critical1 source
China-nexus espionage group Fire Ant has shifted its focus from hypervisors to core control-plane infrastructure, compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts.
According to an investigation by Sygnia, the threat actor modified the underlying execution environments of Cisco IOS XR devices to establish persistence, anti-forensic capabilities, and covert communication channels. On affected routers, investigators discovered an active GRE tunnel interface that was missing from running configurations and commit-history records.
The intrusion toolkit utilized a rogue persistence script disguised as a boot service alongside an implant named `acpid` that executed intermittently to minimize runtime visibility. The attackers deployed a modified IOS XR syslog library designed to intercept and suppress any log events containing the string "Health", returning fake success statuses rather than alerting administrators.
To further mislead network engineers, the malware hooked the CLI command-execution path to append hidden exclusion filters to `show` commands, hiding all trace of malicious VRFs, interfaces, and tunnel configurations.
The group abused administrative workflows to perform packet captures across router interfaces, staging and exfiltrating PCAP dumps to external FTP servers to map topology and capture credentials. Concurrently, Fire Ant attacked TACACS servers using a modular toolset tracked as TacTap, which injected a rogue shared library at `/lib/libseconfd.so` via `/usr/sbin/acppid` directly into the `tac_plus` daemon.
TacTap hooked the `accept` and `accept4` socket APIs to capture live administrator sessions and credential material, writing the data to `/var/log/.tacplus.acct` obfuscated with a single-byte XOR key (`0xEF`).
Additionally, the actors maintained a Linux staging node utilizing a root backdoor dubbed BridgeAgent, which masqueraded as a `zabbix_agent.service` systemd unit and disguised its process name as `/usr/bin/gnome-shell` while probing downstream critical infrastructure targets.
Read more → about Fire Ant Targets Network Core: Cisco IOS XR and TACACS Servers Subverted for Covert Espionagecritical1 source
A joint advisory from the FBI, NSA, and CNMF details the operational tooling of QTFY, a PRC-linked threat actor tied to Nanjing Xinjiuwei Network Technology Co. Active since 2018, the group focuses on targeting US critical infrastructure, the defense industrial base, government agencies, and higher education. In 2024 alone, QTFY compromised over 300 organizations globally by exploiting edge-device vulnerabilities, including Check Point Quantum Gateways. QTFY relies on an in-house reconnaissance platform named 'QScan' to perform automated subdomain enumeration, TLS certificate indexing, and vulnerability scanning. The FBI observed QScan orchestrating over two million scanning and pen-testing jobs in a single 24-hour window. To mask intrusion traffic, the actors route operations through 'QTRouter,' an obfuscation mesh powered by compromised IoT gear and modified OpenWrt firmware. The group actively acquires exploits via freelance cyber contractor marketplaces, rapidly operationalizing zero-day and N-day flaws against their pre-cataloged asset database. Persistence is established via web shells, remote access trojans, and stolen valid credentials. Attack traffic routinely emerges from residential or nearby IoT proxy nodes, blending into normal egress noise. The US Department of Justice and the FBI have announced coordinated disruption operations against the QScan and QTRouter infrastructure.
Read more → about FBI Dissects QTFY: How a Contractor-Backed Threat Actor Leverages Custom 'QScan' and 'QTRouter' Mesh Platformshigh1 source
A comprehensive study by German digital industry association Bitkom revealed that 96% of surveyed companies experienced or likely experienced data theft, industrial espionage, or sabotage over the past year. The research sampled more than 1,000 businesses generating at least one million euros in annual revenue and employing ten or more staff. Among definitively targeted firms, 37% linked at least one attack directly to foreign intelligence services, reflecting a climb from 28% the prior year. Attribution relied heavily on log file inspection, which served as the primary technical mechanism in 68% of incidents, alongside intelligence tips from government agencies for half of the identifying victims. Threat actors based in China and Russia were the most frequently identified, cited by 52% and 49% of affected firms respectively. Total estimated economic damages reached between 211 billion and 270.8 billion euros. Interestingly, definitive victim certainty fell by twenty percentage points while unprovable suspicions surged from 10% to 29%. This visibility gap stems largely from threat actors pivoting away from loud ransomware deployments toward stealthy espionage operations. Overall, 59% of respondents admitted that inadequate incident detection mechanisms contributed significantly to attacker success.
Read more → about Covert Espionage and Intelligence Threats Leave German Industry in the Dark