China-linked Fire Ant Hides Inside Trusted Infrastructure
Brief
Fire Ant hijacked Cisco routers, stole credentials and altered logs to hide its tracks, using trusted infrastructure to reach high-value networks.
Chinese-linked cyber espionage group Fire Ant has spent the past year quietly graduating from hacking individual computers to hacking the infrastructure that connects them. Sygnia’s new report traces how the group expanded from compromising hypervisors into routers, authentication servers, and Linux management hosts, the unglamorous plumbing that decides who gets to log in where and what gets recorded when they do.
The investigation started with something that looked like a minor configuration mistake. A tunnel interface showed up as active on a Cisco IOS XR router with no corresponding entry in the configuration history, no commit anyone could point to that explained how it got there.