Fire Ant Uses Cisco IOS XR Routers to Capture Traffic and Hide Attack Activity

480/69 Wednesday, September 2, 2026 Security researchers have disclosed attacks by the Fire Ant group targeting infrastructure used by organizations to connect and manage networks, including Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. The attackers used these systems to maintain access, capture network traffic and credentials, and pivot to other connected systems. The activity was initially identified from a GRE tunnel running on a Cisco IOS XR router that did not appear in the configuration or commit history. The report has not identified how the attackers initially gained access to the Cisco IOS XR routers. After compromising the systems, the attackers used malware designed for IOS XR to hide syslog entries and conceal command output on the routers. They also captured network traffic as PCAP files and exfiltrated it to an external FTP server. This activity could expose network architecture, administrator connections, authentication processes, and routing relationships. In addition, researchers found a tool named TacTap on TACACS systems to collect credentials, and a backdoor named BridgeAgent on a Linux host connected to the GRE tunnel to provide access and execute additional payloads. Administrators should inspect for unauthorized GRE or other tunnels, inconsistencies between runtime state and configuration, unexpected PCAP file creation, FTP/SCP data transfers, gaps in command accounting, and abnormal shell access. They should also review TACACS and Linux management hosts using the indicators of compromise published by Sygnia. If evidence of compromise is found, affected systems should be isolated, the scope of access should be investigated, and administrator credentials that may have been exposed should be changed.