On August 31, 2026, incident-response firm Sygnia published new detail on Fire Ant, a China-nexus intrusion set whose tooling and tradecraft overlap with UNC3886. Where most actors fight for a foothold on endpoints, Fire Ant lives one layer lower — inside Cisco IOS XR routers, TACACS+ authentication servers, Linux management hosts, and VMware hypervisors.
The campaign is defined by patience and log discipline: implants that filter the router's own outgoing logs for the word "Health," a command path rewritten to hide configuration, credential theft hooked directly into TACACS+, and Linux backdoors that masquerade as Zabbix monitoring or SentinelOne and Cybereason agents. Components planted in 2025 were still being reused in 2026.
◈ Table of Contents
The Threat Actor
Phase 01| Attribute | Detail |
|---|---|
| Cluster | Fire Ant |
| Overlap | UNC3886 (China-nexus espionage) — Sygnia notes overlap, no conclusive attribution |
| Focus | Network edge & virtualization: routers, TACACS+, Linux jump hosts, ESXi/vCenter |
| Objective | Long-dwell espionage and persistent network control |
| Reported by | Sygnia (incident response) |
| Timeline | Initial VMware activity disclosed July 2025; hands-on activity continuing into 2026 |
Fire Ant targets exactly the assets most EDR deployments can't see: appliances and hypervisors. Any threat model that assumes "we have endpoint coverage" underestimates an actor who never touches a Windows endpoint agent.
Kill Chain & TTPs
Phase 02| exclude filter to the command-execution path so its own configuration never shows in operator output.- 1Hidden GRE tunnel interface operating without a visible running config.
- 2Boot persistence via
/etc/rc.d/init.d/grub-rommon. - 3Packet captures collected on-device and pushed to external FTP servers.
/var/log/.tacplus.acct obfuscated with a single-byte XOR (key 0xEF). Owning TACACS+ means owning authentication for the whole managed network fabric.zabbix_agent.service systemd unit and beaconing over TLS on port 443. SELinux was disabled and login/privileged-command history rewritten.The "Health"-string log filter is the signature move here: the router still logs, but the operator's own noise is scrubbed before it leaves the box. Trusting on-device show output during triage of a suspected edge compromise is exactly the mistake this tradecraft is built to exploit.
Implant Toolset
Phase 03| Implant | Role | Notes |
|---|---|---|
| TacTap | TACACS+ credential theft | Library injection; XOR 0xEF to .tacplus.acct |
| BridgeAgent | Linux backdoor | Fake Zabbix agent; TLS/443; systemd persistence |
| Medusa / REPTILE | Rootkits | Kernel/user-mode hiding on Linux hosts |
| VMCI backdoor | Hypervisor comms | /var/tmp/audit — guest/host channel |
| Packet-triggered backdoor | Dormant listener | /var/tmp/ping — wakes on crafted packet |
| Fake EDR binaries | Masquerade | Impersonate SentinelOne / Cybereason agents |
Indicators of Compromise
Phase 04| Artifact | Path | SHA1 |
|---|---|---|
| TacTap | /usr/sbin/acppid | 36005f5e4398a1c62a2a9271eddfcc1b44b1ad00 |
| TacTap lib | /lib/libseconfd.so | 955cd45a2f6f226a2fdf44b329af1c8dde90cb38 |
| IOS XR implant | /usr/bin/acpid | be6b27f429324a4af05a310d8ec9635e37c68a94 |
| IOS XR implant | /pkg/bin/dhcpd_show_issu_status | 1682b652a15bde732489f22809b0b7594c228fd3 |
| IOS XR implant | /pkg/bin/hd | b149fa3a34bd585e7a674a4fd9538437bd06f514 |
| VMCI backdoor | /var/tmp/audit | 13f0c2a598e3aa63856c032a96b110aed963f0e8 |
| Packet backdoor | /var/tmp/ping | 5ba1242050b5b447052b210788a5a25593d6987d |
| Credential file | /var/log/.tacplus.acct | XOR 0xEF-obfuscated captured creds |
| Config (BridgeAgent) | /opt/.ICEauthority | Encrypted config; persist via zabbix_agent.service |
Detection & Hunt
Phase 05Hunt from a vantage point the implants cannot rewrite: out-of-band collection, external NetFlow, and file-integrity baselines rather than on-device output.
- File-integrity drift on IOS XR system binaries vs. known-good images
- GRE tunnel interfaces with no corresponding running config
- Outbound FTP from routers or management hosts (PCAP staging)
- SELinux unexpectedly disabled; rewritten shell history
- "Zabbix", "SentinelOne" or "Cybereason" binaries with wrong hashes/paths
MITRE ATT&CK Mapping
Phase 06| Tactic | Technique | Use |
|---|---|---|
| Command & Control | T1071 Application Layer Protocol | BridgeAgent TLS/443 beacon |
| Persistence | T1547 Boot/Logon Autostart | systemd unit + grub-rommon init script |
| Defense Evasion | T1140 Deobfuscate/Decode | XOR key 0xEF credential store |
| Defense Evasion | T1562 Impair Defenses | Log filtering, SELinux disabled, history wipe |
| Collection | T1040 Network Sniffing | On-device PCAP capture |
| Credential Access | T1556 Modify Authentication Process | TACACS+ connection hooking |
Sources
Phase 07Fire Ant proves the network edge is inside your threat model whether you monitor it or not. Baseline your appliance and hypervisor images, then check the artifact hashes above against the CyberHawk IOC Scanner and follow live campaign tracking on Threat Intel.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."