China-linked cyber group reportedly targets Cisco Routers

Beijing [China], September 3 (ANI): A China-linked cyberespionage group compromised Cisco routers, hid its activity from network administrators and used the devices to monitor network traffic and search for access to other important networks, according to cybersecurity firm Sygnia. The findings were reported by The Epoch Times, citing Sygnia’s investigation into the group, which it calls Fire Ant.
Sygnia said Fire Ant targeted Cisco routers running IOS XR and installed malware designed to operate on these devices. The company has not linked the group to any specific Chinese government agency and has not revealed the affected organisations or countries.
According to the report, the investigation began after researchers discovered a hidden network tunnel operating through a Cisco router. The connection was not visible in the router’s normal configuration records. Sygnia later found malware that could suppress some router logs and change the information shown to administrators, helping the hackers remain undetected.
The group also collected network traffic passing through several compromised Cisco routers and sent the captured data to external servers. In some cases, the hackers reportedly used legitimate administrator accounts, making their activity appear like normal network operations.
According to the report, Fire Ant also targeted TACACS, a system used to verify whether administrators are authorised to access routers and other network equipment. Sygnia discovered malware called TacTap, which could capture administrator login credentials during the login process. The firm said it had not previously seen this technique publicly documented.
The report mentioned that the hackers also used compromised systems to test connections to other high-value networks, including critical infrastructure. Sygnia found evidence of scanning and connection attempts but did not confirm that these additional systems were successfully breached.
Sygnia said Fire Ant’s methods were similar to those linked to UNC3886, another China-linked cyberespionage group investigated by Google-owned Mandiant. However, Sygnia has not confirmed that the two groups are the same. The activity comes amid wider warnings about Chinese cyber operations targeting network infrastructure.
As reported by The Epoch Times, a 2025 advisory by U.S. and allied cybersecurity agencies warned of Chinese state-backed hackers targeting routers and telecommunications equipment through hidden tunnels, credential theft and traffic collection. (ANI)