Fire Ant Uses Compromised Cisco Routers to Spy on High-Value Networks
Summary
Sygnia reports that Fire Ant compromised Cisco routers and related systems to capture network traffic and reach connected high-value environments, using hidden GRE tunnels, custom malware and a disguised backdoor called BridgeAgent.
Key points
- Sygnia found an unexplained GRE tunnel on a Cisco IOS XR router; the tunnel linked a compromised router to a legacy Linux server used for staging and reconnaissance.
- Fire Ant used router access to capture traffic and upload PCAP files to external FTP servers, potentially exposing network topology, administrative connections and authentication flows.
- Custom malware suppressed selected syslog messages, enabled unlogged interactive shell access and used a fake system service to run the implant during alternating hours.
- The attackers used the compromised infrastructure to probe connected high-value environments, including systems associated with critical infrastructure.
- Sygnia identified BridgeAgent, a backdoor disguised as a Zabbix monitoring agent that persists as a root-level systemd service and supports TLS reverse shells and payload execution.
- Sygnia reported strong overlap with UNC3886 but noted differences in filenames, paths and implementation details.
- The researchers said Fire Ant tampers with logs and timestamps, and shared IoCs, hunting guidance and YARA rules; they advised validating compromised-system logs against other data.
Article Details
- Attack Vectors
- Fire Ant compromised Cisco routers, TACACS authentication servers, and Linux management hosts.
- The group used a concealed GRE tunnel between a compromised router and a legacy Linux server for staging and reconnaissance.
- Custom malware established fake system-service persistence, suppressed syslog messages, and enabled outbound Telnet connections and interactive shell access.
- Attackers captured router traffic and uploaded PCAP files to external FTP servers.
- From the legacy Linux server, attackers probed systems in connected high-value environments over ports used for SSH, web services, SMB/RPC, and RDP.
- BridgeAgent was disguised as a Zabbix monitoring agent and provided TLS reverse shells and additional payload execution.
- Defensive Notes
- Validate logs retrieved from compromised infrastructure against other data because Fire Ant tampers with logs and records, including file timestamps.
- Sygnia's report includes hunting and YARA rules for detecting Fire Ant activity.
MITRE ATT&CK
T1040 · Network SniffingAttackers captured traffic from multiple routers to inspect internal topology, administrative connections, and authentication flows.T1046 · Network Service DiscoveryFrom a legacy Linux server, Fire Ant probed systems in connected high-value environments over commonly used service ports.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolAttackers uploaded captured router PCAP files to external FTP servers.T1070.006 · TimestompFire Ant changed file timestamps to obscure evidence.T1543.002 · Systemd ServiceBridgeAgent persisted as a root-level systemd service on a compromised host.T1572 · Protocol TunnelingFire Ant used a concealed GRE tunnel between a compromised Cisco router and a legacy Linux server.
Threat Actors
Malware
Vendors
Products
Cisco IOS XRA hidden GRE tunnel was found on a Cisco IOS XR router with no matching config history.VMwareSygnia found that Fire Ant shifted from VMware hypervisors to Cisco routers, TACACS servers, and Linux management hosts, using a hidden GRE tunnel and custom malware to maintain persistence and spy on traffic.ZabbixSygnia uncovered BridgeAgent, a disguised Zabbix backdoor with TLS reverse shells and payload execution.