China-Linked Hackers Turn Cisco Routers Into Covert Attack Infrastructure

China-linked Fire Ant uses Cisco routers for credential theft and log suppression

A China-linked intrusion set tracked as Fire Ant was reported exploiting Cisco routers to steal credentials and interfere with security logging, turning edge network devices into collection and concealment points. The activity is detailed in...

China-linked hackers turn Cisco routers into covert attack infrastructure

A China-linked cyber espionage group has expanded beyond VMware environments to target network and authentication infrastructure that enterprises rely on to manage access and administer critical systems, according to new findings from incident response firm Sygnia. The threat actor, tracked by Sygnia as Fire Ant, targeted Cisco IOS XR routers in 2026, using them to collect network traffic while suppressing evidence of its activity. The attackers…

Hackers Compromise Cisco Routers to Spy on Networks and Reach Critical Infrastructure

Fire Ant has moved beyond attacking individual systems and is now compromising network infrastructure that organizations trust to move traffic and manage access. The actor has turned Cisco IOS XR routers into platforms for surveillance, remote connectivity, and movement toward high-value environments. The campaign shows how an intruder can use a router as more than […] The post Hackers Compromise Cisco Routers to Spy on Networks and Reach Critic…

Fire Ant Hackers Compromise Cisco Routers and TACACS Servers to Target Critical Infrastructure

China-nexus threat actor Fire Ant has expanded its espionage operations from VMware hypervisors to the trusted infrastructure layer, compromising Cisco… Read more → The post Fire Ant Hackers Compromise Cisco Routers and TACACS Servers to Target Critical Infrastructure appeared first on IT Security News.

China-linked hackers turn Cisco IOS XR routers into covert attack infrastructure

A China-linked cyber espionage group has expanded beyond VMware environments to target network and authentication infrastructure that enterprises rely on to manage access and administer critical systems, according to new findings from incident response firm Sygnia. The threat actor, tracked by Sygnia as Fire Ant, targeted Cisco IOS XR routers in 2026, using them to collect network traffic while suppressing evidence of its activity. The attackers…