A China-linked espionage group is hijacking Cisco routers and turning them into listening posts on networks they don't even own.
Security firm Sygnia says the group, tracked as Fire Ant, has expanded well past its original focus on virtualization platforms. It's now going after Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. On compromised routers, Fire Ant doesn't just use them as a hop point - it captures traffic, opens its own connections, edits command output, and suppresses logging to avoid detection. On TACACS servers, the systems admins use to log into network hardware, it harvests credentials and undermines audit trails. On Linux hosts, Sygnia found persistent backdoors, including a custom SSH implant and malware disguised as legitimate software.
The real target here usually isn't the network Fire Ant breaks into - it's everyone connected to it. Sygnia describes this as a "target behind the target" approach: control one organization's infrastructure long enough, and you inherit the trust relationships it has with partners, vendors, and clients. That's a fundamentally different threat model than a smash-and-grab data theft - it's building a standing surveillance post inside infrastructure people assume is clean.
Attribution is still murky. Researchers note overlaps with UNC3886, a Chinese group Google has tracked before, but the differences are big enough that nobody's calling it the same crew - a reminder that with state-linked hacking, what got exposed usually matters more than who's credited for it.