THREAT OPS › Threat News › China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks.
Sygnia, the incident response firm that investigated the intrusion, said the actor
MITRE ATT&CK techniques
- CredentialsT1589.001