Fire Ant, a Chinese espionage-linked threat actor, is expanding its infrastructure playbook beyond VMware hypervisors and into network and management systems, according to research summarized by BleepingComputer. Incident response firm Sygnia reported that the group compromised Cisco routers, TACACS authentication servers, and Linux management hosts, turning trusted infrastructure into a platform for surveillance and onward reconnaissance. The investigation began with an anomaly on a Cisco IOS XR router: an active Generic Routing Encapsulation, or GRE, tunnel interface that could not be matched to the router’s running configuration or commit history, BleepingComputer reports. That gap mattered because it suggested activity present on the device but absent from the administrative records operators would normally rely on to understand the router’s state. Sygnia’s analysis found custom malware on the compromised devices. According to BleepingComputer, the implant persisted through a fake system service and was configured to run only during alternating hours, a timing pattern that could reduce the chance of detection during routine checks. The malware also selectively suppressed syslog messages related to tunnel activity, established outbound Telnet connections to Fire Ant-controlled infrastructure, and enabled interactive shell access without logging. The router access was not limited to maintaining a foothold. BleepingComputer reports that the attackers used administrative access to capture traffic from multiple routers, then uploaded PCAP files to external FTP servers. Sygnia said those captures could reveal internal topology, administrative connections, authentication flows, routing relationships, and traffic moving between connected networks. The strategic significance is that a router is not just another endpoint. In Sygnia’s view, once Fire Ant controlled the router, it could use the device as an observation point inside trusted paths. BleepingComputer reports that a concealed GRE tunnel linked one compromised router to a legacy Linux server, which Fire Ant used for staging and reconnaissance. From that Linux system, the attackers probed connected high-value environments, including systems associated with critical infrastructure, over ports commonly used for Secure Shell, web services, Server Message Block/Remote Procedure Call, and Remote Desktop Protocol. Sygnia described the pattern as a “target behind the target” approach: compromise infrastructure at one victim, then use that trust position to explore paths into connected networks. The report also identified a previously undocumented backdoor called BridgeAgent. BleepingComputer says Fire Ant disguised BridgeAgent as a legitimate Zabbix monitoring agent; it persisted as a root-level systemd service and supported Transport Layer Security reverse shells and execution of additional payloads on the compromised host. Attribution remains nuanced. Sygnia said Fire Ant activity strongly overlaps with UNC3886, a Chinese espionage group previously documented by Google, while also noting differences in filenames, paths, and implementation details. The provided reporting does not identify a specific Cisco vulnerability; it describes compromised routers and administrative access being used for collection and movement. For defenders, the operational warning is as important as the malware names. Sygnia said Fire Ant tampers with system logs and records, including changing file timestamps, so logs recovered from compromised infrastructure should be checked against other data. BleepingComputer also reports that Sygnia published indicators of compromise, hunting guidance, and YARA rules for Fire Ant activity. Who benefits: Security teams benefit from Sygnia’s published indicators, hunting guidance, and YARA rules. Attackers benefit when routers, authentication systems, and management hosts are treated as trusted plumbing rather than actively monitored assets. Who's exposed: Organizations running Cisco IOS XR routers, TACACS authentication infrastructure, and Linux management hosts are the directly relevant audience based on the report. Environments connected to trusted third-party or adjacent networks may also face exposure if an initial victim’s infrastructure is used as a bridge.