#bridgeagent

Fire Ant Operatives Pivot to Cisco Routers and Linux Management Infrastructure for Covert Traffic Sniffing

Incident responders at Sygnia identified a sophisticated campaign attributed to the Chinese cyber espionage threat group known as Fire Ant, showing a notable tactical shift away from VMware hypervisors toward core network infrastructure. Investigators uncovered an active Generic Routing Encapsulation (`GRE`) tunnel interface on a Cisco IOS XR router that had no corresponding configuration record or commit history. The attackers established persistent access via custom malware executing as a disguised system service designed to run strictly during alternating hours to evade detection. To keep operators blind, the implant intercepted and suppressed syslog messages related to the tunnel, facilitated interactive unlogged shells, and maintained outbound Telnet communication to external attacker servers. Beyond basic command execution, the group leveraged administrative access on multiple compromised routers to run raw packet captures, funneling the resulting PCAP files out to external FTP servers. These covert captures exposed internal topologies, raw authentication flows, administrative connections, and sensitive traffic traveling across trusted pathways. The stealthy `GRE` tunnel bridged compromised network gear directly to a legacy Linux staging host inside the victim's environment. From this intermediary beachhead, the adversaries performed targeted reconnaissance across adjacent high-value environments, including critical infrastructure assets, probing services like SSH, SMB/RPC, RDP, and HTTP interfaces. On the Linux side, analysts discovered a brand new backdoor dubbed `BridgeAgent` that masqueraded as a genuine Zabbix monitoring agent, maintaining persistence as a root-level `systemd` service. `BridgeAgent` handled TLS-encrypted reverse shells and functioned as a modular drop point for subsequent attack stages, all while operators meticulously tampered with system logs and modified filesystem timestamps to hinder forensics. Sygnia noted extensive operational overlap between Fire Ant and the Chinese espionage nexus previously tracked by Google as UNC3886, despite minor divergences in specific filenames and implementation logic.