New research published on 30 August 2026 describes fresh activity by the China-nexus threat cluster tracked as Fire Ant, targeting Cisco IOS XR routers, TACACS authentication infrastructure and Linux management hosts.

The distinguishing characteristic is not the initial compromise, which was never observed, but what followed: the devices were modified so that the logs, configuration output and authentication records administrators rely on no longer described what those devices were actually doing.

The investigation began from one inconsistency. A GRE tunnel interface was operational in a specific VRF on a compromised router, with no corresponding entry in the running configuration and no commit history explaining its creation. Operational state and configuration state disagreed, and only one of them was true.

Campaign at a Glance

Control-Plane Implants on Cisco IOS XR

Three purpose-built binaries were deployed on the compromised routers, each disguised as a system utility and each performing a distinct function.

The first two attack the two channels through which an administrator would learn about the device. A collector keeps receiving health messages and little else, so the absence of events reads as a quiet device rather than a broken one, while an operator running the exact command that would expose an anomaly gets output with the anomaly removed. The filtering and the undocumented tunnel are presented as one operation; the direct claim that the filter existed to conceal that specific tunnel is a reasonable reading of the source rather than an explicit finding. The actor also disabled SNMP trap generation and authentication request logging, and exfiltrated packet captures to external FTP servers.

TacTap: Credential Interception on TACACS

A TACACS server answers who may log in to network infrastructure and records what they then did. Compromising one yields the credentials and the audit trail describing their use.

The toolset performing this, named TacTap, has two components. The injector /usr/sbin/acppid loads /lib/libseconfd.so into the running tac_plus process, where it hooks accept() and accept4() and passes accepted socket file descriptors back over the UNIX socket /var/run/acpid.lock, using descriptor passing rather than copying session data. Harvested credentials are written to /var/log/.tacplus.acct, obfuscated with a single-byte XOR using key 0xEF. Two YARA rules covering it have been published.

BridgeAgent and Other Linux Implants

BridgeAgent masquerades as a Zabbix monitoring agent. Each of its design choices defeats a different routine check:

• The binary is named zabbix_agent, one character from the legitimate zabbix_agentd, surviving a visual scan of a process list.

• Persistence is a zabbix_agent.service systemd unit running as root with automatic restart, identical in form to a real monitoring deployment.

• The process spoofs its own command line as /usr/bin/gnome-shell, misleading tooling that reads cmdline rather than the executable path.

• Configuration sits AES-encrypted at /opt/.ICEauthority, holding controller host, port, polling interval, host identifier and reverse-shell parameters.

• Command and control is HTTPS polling over port 443, blending with ordinary outbound traffic from a management host.

• It launches a secondary binary, ntfsfixed, whose own command line contains the string KS2ow2232ssww2342234323.

Two further implants appear. A VSOCK/VMCI backdoor was recovered from the TACACS server at /var/tmp/audit. A packet-triggered implant resembling the REPTILE rootkit sat at /var/tmp/ping, activating on specific TCP and UDP ports given the string sxcdewqaz!@# and terminating on hpaVAj2FJ. These markers belong to that implant and should not be conflated with the BridgeAgent string above.

Anti-Forensics and Agent Impersonation

The consistent investment is in degrading the evidence available to an investigator rather than evading a particular product. On network devices this meant suppressing logs, hiding commit activity, suppressing AAA requests and SNMP traps, and filtering command output. On Linux hosts:

• Files deleted after execution, with the resulting processes left running from paths no longer on disk.

• SELinux disabled through a modified /etc/selinux/config.

• iptables redirection of inbound port 22 to port 443, with IPv4 forwarding enabled.

• Login records rewritten. The router address was replaced with an innocuous internal one inside /var/log/wtmp, utmp and btmp using utmpdump with sed, alongside sed -i /sudo/d against files in /var/log.

The impersonation of endpoint software illustrates the approach best. The REPTILE-like binary was renamed to resemble the files of a widely deployed commercial EDR agent, moved into that agent's own directory, timestomped to match its neighbours, and executed from there. The same technique appeared once more against a second EDR product's path. The objective is not to disable the security product but to place tooling in the one directory an analyst is least likely to question.

Attribution

Fire Ant is assessed to overlap strongly with UNC3886, a China-nexus espionage cluster documented in earlier industry research, on durable behaviours rather than infrastructure: VMCI-based backdoors, TACACS credential theft, Medusa rootkit use, custom SSH access and router-focused operations. Two artefact-level details support this. The 0xEF XOR key matches that documented in earlier UNC3886 TACACS tooling, and the packet-triggered implant reuses the documented hpaVAj2FJ termination marker while replacing the documented activation marker mznCvqSBo.

Conclusive attribution is nonetheless withheld, on the grounds that several filenames, paths and deployment details differ from earlier UNC3886 reporting, and that shared tooling across Chinese intrusion sets means a false flag cannot be excluded. Two points are worth stating plainly, since they tend to drift in secondary coverage: the prior UNC3886 attribution covers the 2021 to 2023 VMware activity, and attribution of this router campaign remains open; and the original China-nexus judgement, made in September 2022, was issued at low confidence and strengthened later.

The 2025 Hypervisor Campaign

This is an evolution of activity disclosed on 24 July 2025, when the same cluster targeted VMware ESXi and vCenter. The philosophy is identical and only the layer has changed, from the platform servers run on to the platform the network runs on.

Initial access to vCenter was assessed as exploitation of CVE-2023-34048, an unauthenticated out-of-bounds write in the DCERPC implementation rated CVSSv3 9.8 in VMSA-2023-0023 and added to the CISA KEV catalog with a February 2024 remediation date. That assessment was inferred from vmdird process crashes preceding the first malicious activity, together with deleted core dumps, rather than from a recovered exploit. Fixed versions are 8.0U1d, 8.0U2 and 7.0U3o, with Cloud Foundation covered through KB88287 and asynchronous patches for end-of-life 6.5 and 6.7. Earlier research indicates the flaw was held as a zero-day from late 2021, roughly eighteen months before the patch.

What followed rhymes with 2026. Guest commands were executed without in-guest credentials via CVE-2023-20867 and PowerCLI Invoke-VMScript; unsigned VIBs were installed with --force after their acceptance level was altered to partner; and a backdoor at /usr/libexec/setconf/ksmd listened on TCP 7475. For anti-forensics, the ESXi vmsyslogd daemon was terminated, stopping local writing and remote forwarding at once, and unregistered virtual machines were run by invoking /bin/vmx -x directly so they never appeared in vCenter inventory and could be found only by inspecting physical switch MAC tables.

Indicators of Compromise

Hashes are SHA1.

Signature coverage extends to the TacTap components. For BridgeAgent and the Medusa variant, the paths, service names and strings above are the indicators available to hunt on.

Detection and Response

This activity is post-access tradecraft rather than a patchable flaw, so the guidance below is detection-oriented.

• Reconcile operational state against configuration state on network devices. The intrusion surfaced because a tunnel was running with no matching configuration. Comparing what a device does against what its configuration says it should do is the most transferable detection here, and it does not depend on any indicator staying current.

• Treat gaps in telemetry as findings, not quiet periods. Unexplained absences in AAA records, syslog delivery or SNMP trap volume are the expected signature of the log suppression described, and a device reporting only health messages is a pattern worth alerting on.

• Inspect the tac_plus process for injected libraries, and check TACACS servers for /var/run/acpid.lock and /var/log/.tacplus.acct. Apply the two published TacTap YARA rules to those hosts.

• Hunt the masquerading patterns directly. A zabbix_agent unit rather than zabbix_agentd; any process whose command line claims /usr/bin/gnome-shell while its executable path says otherwise; and files inside endpoint agent directories whose timestamps match their neighbours too precisely. The two impersonated products are named in the source material.

• Alert on log-tampering utilities. Execution of utmpdump or sed against /var/log/wtmp, utmp or btmp has almost no legitimate use. Check also for a modified /etc/selinux/config, port 22 redirected to 443, and processes whose backing executable is gone from disk.

• Apply the hypervisor guidance in parallel. Look for /bin/vmx -x execution, VMs absent from vCenter inventory, and guest MACs outside assigned ranges. Enable UEFI Secure Boot on ESXi hosts to neutralise forced installation of unsigned VIBs.

• Preserve infrastructure evidence before remediating. Routers, TACACS servers, hypervisors and jump hosts are first-class forensic assets. Where an actor invests principally in corrupting one evidence source, corroboration across memory, disk, network and configuration is the only reliable basis for a finding.

Open Questions for Defenders

Initial access to the routers and Linux hosts is still undetermined, so exposure assessment rests on hunting rather than checking a version number. Whether IOS XR image signing detects replacement of binaries under /pkg/bin, and whether a privileged installation path was required, remains to be established, as does victimology and geographic distribution. Two findings are inferential rather than directly observed and should be carried forward as such: the assessed exploitation of CVE-2023-34048 rests on process-crash correlation rather than a recovered exploit, and the stated alignment between the ksmd backdoor and VIRTUALPITA is a hash-based assessment.

The absence of a CVE is the most consequential detail here. This describes what an adversary does with legitimate administrative capability, on device classes where endpoint detection cannot be deployed and where the device's own account of itself is the primary evidence available. That makes it a monitoring and evidence-integrity problem, and one that rewards investment in detection engineering and forensic readiness on infrastructure devices.