#TACACS

Fire Ant Targets Network Core: Cisco IOS XR and TACACS Servers Subverted for Covert Espionage

China-nexus espionage group Fire Ant has shifted its focus from hypervisors to core control-plane infrastructure, compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. According to an investigation by Sygnia, the threat actor modified the underlying execution environments of Cisco IOS XR devices to establish persistence, anti-forensic capabilities, and covert communication channels. On affected routers, investigators discovered an active GRE tunnel interface that was missing from running configurations and commit-history records. The intrusion toolkit utilized a rogue persistence script disguised as a boot service alongside an implant named `acpid` that executed intermittently to minimize runtime visibility. The attackers deployed a modified IOS XR syslog library designed to intercept and suppress any log events containing the string "Health", returning fake success statuses rather than alerting administrators. To further mislead network engineers, the malware hooked the CLI command-execution path to append hidden exclusion filters to `show` commands, hiding all trace of malicious VRFs, interfaces, and tunnel configurations. The group abused administrative workflows to perform packet captures across router interfaces, staging and exfiltrating PCAP dumps to external FTP servers to map topology and capture credentials. Concurrently, Fire Ant attacked TACACS servers using a modular toolset tracked as TacTap, which injected a rogue shared library at `/lib/libseconfd.so` via `/usr/sbin/acppid` directly into the `tac_plus` daemon. TacTap hooked the `accept` and `accept4` socket APIs to capture live administrator sessions and credential material, writing the data to `/var/log/.tacplus.acct` obfuscated with a single-byte XOR key (`0xEF`). Additionally, the actors maintained a Linux staging node utilizing a root backdoor dubbed BridgeAgent, which masqueraded as a `zabbix_agent.service` systemd unit and disguised its process name as `/usr/bin/gnome-shell` while probing downstream critical infrastructure targets.