China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

Sygnia attributed a sophisticated China-nexus espionage campaign (tracked as Fire Ant and linked to public reporting on UNC3886) that escalated from VMware hypervisors into Cisco IOS XR routers, TACACS servers, and Linux management hosts; the actor used purpose-built router implants, a TACACS credential-stealer (TacTap), a Linux backdoor (BridgeAgent), and other rootkits/backdoors to capture packet data, harvest credentials, suppress logging, and maintain long-term access, with a full set of IoCs published.