Fire Ant: China-Nexus Actor Burrows into Cisco IOS XR Routers

Sygnia details Fire Ant, a China-nexus cluster overlapping UNC3886, hijacking Cisco IOS XR routers, TACACS+ servers and Linux hosts with stealth implants and log suppression.