Fire Ant turns Cisco routers into covert spying platforms with invisible GRE tunnels
On August 31, 2026, Sygnia documented how the Chinese espionage group Fire Ant, which heavily overlaps UNC3886, pivoted from VMware hypervisors to Cisco IOS XR routers to intercept the traffic passing through them. An active GRE tunnel missing from the running config is enough to turn a transit router into a collection platform — and it means defenders must audit routers as vantage points, not as mere hops.
August 31, 2026. Incident response firm Sygnia published a detailed report on Fire Ant, a Chinese espionage group that substantially overlaps UNC3886, the actor documented by Google. August 31, 2026. BleepingComputer covered the findings. The pivot is the headline: the actor is no longer going after VMware hypervisors but Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. Why does that matter? A core router already sits on a mandatory path for traffic; compromising one means planting an ear at the center of the network.
A GRE tunnel nobody configured
The story starts with an anomaly network teams notice far too rarely. On a Cisco IOS XR router, Sygnia analysts found an active GRE (Generic Routing Encapsulation) tunnel interface. The catch: it appeared neither in the running configuration nor in the commit history. A GRE tunnel does not create itself — its absence from the configuration is the signature of a change made outside configuration management.
That detail is the whole point. Routers are managed through versioned configuration files; an interface that is missing from them escapes reviews, configuration diffs, and compliance tooling. That is precisely the space Fire Ant occupies: the gap between what a device actually does and what the inventory believes it does.
From transit gear to a vantage point
Sygnia’s report states the finding that changes the picture. Historically, a compromised router served as a relay — an attacker used it to hop, or to intercept traffic intermittently. Fire Ant goes further. By placing a core router under its control, the group shifts “the router’s role from a transit device to a collection platform.” The sentence deserves a second read: the device becomes “a vantage point for observing traffic moving through trusted network paths.”
The mechanics are simple and effective. The concealed GRE tunnel links the compromised router to a legacy Linux server used as a staging and reconnaissance system. From there, the attacker probes connected high-value environments — including systems tied to critical infrastructure — over the usual SSH, web-service, SMB/RPC, and RDP ports.
Malware built to stay invisible
Fire Ant’s persistence matches its stealth. The malware deployed on the devices relies on a fake system service that runs the implant only during alternating hours. In other words, the implant does not run continuously: it activates in time windows, which complicates detection through continuous monitoring and makes its activity look like legitimate noise.
More importantly, the malware selectively suppresses syslog messages tied to the tunnel. For an administrator reading logs, the concealed GRE tunnel does not exist — the very records that would reveal it are filtered before they are even written. The malware also opens outbound Telnet connections to Fire Ant infrastructure and provides an interactive shell with no logging. The result: the attacker operates on the device without leaving exploitable traces.
The attackers take the operation further by capturing traffic from multiple routers and exfiltrating PCAP files to external FTP servers. Those captures expose internal topology, authentication flows, routing relationships, and traffic exchanged with connected networks. For an intelligence operator, that is a trove — the equivalent of a living architecture diagram of the victim’s network.
BridgeAgent, a backdoor disguised as a monitoring agent
The report’s other finding is a previously undocumented backdoor named BridgeAgent. Its trick is to masquerade as a legitimate Zabbix monitoring agent. Under that disguise, the backdoor persists as a root-level systemd service and supports TLS reverse shells as well as the execution of additional payloads on the compromised host.
The choice of disguise is deliberate. Monitoring agents are everywhere on managed infrastructure, frequently excluded from detection rules, and their presence on a management host is expected. By blending into that category, BridgeAgent exploits the same blind spot as the off-config GRE tunnel: it looks like what the environment expects, so nobody looks at it.
“The target behind the target”
Sygnia summarizes Fire Ant’s strategy with a phrase: “the target behind the target.” The operation is not about the first victim itself. It consists of compromising trusted infrastructure at an initial victim, then using it as a covert bridge to explore access paths into the high-value networks connected to it.
That approach changes how you reason about risk. A router, a TACACS server, or a management host is not just an asset to protect: it is a potential launching point toward more sensitive assets. Compromising equipment seen as “intermediate” can be the first step in a chain that leads to a customer’s or partner’s critical infrastructure.
Solid attribution, with local variants
Sygnia ties Fire Ant’s activity to UNC3886, the Chinese espionage group documented by Google, with strong overlap. The report adds a caveat, though: differences remain in filenames, paths, and implementation details. In plain terms, this is either the same actor evolving its arsenal, or a subgroup or imitator sharing the same modus operandi. Either way, the operational conclusion is identical: network management infrastructure is a priority target.
The researchers also warn that Fire Ant systematically tampers with logs and records, down to file timestamps, to erase evidence that would help investigators. The corollary matters for incident response: logs recovered from compromised infrastructure must be validated against other data before being taken at face value.
What it changes for defense
Sygnia’s report ships a list of indicators of compromise (IoCs), hunting rules, and YARA rules to detect Fire Ant. But beyond signatures, the episode imposes three structural reflexes:
- Reconcile configuration with reality: any active GRE or tunnel interface missing from both the config and the commit history is an alert, not a curiosity.
- Treat the router as a vantage point: the traffic crossing it is intelligence; its compromise turns the device into a sensor for the attacker.
- Distrust the logs themselves: a syslog going silent on an expected activity is precisely the symptom to hunt for, because the attacker filters before writing.
The detection gap this exposes
The reason Fire Ant gets away with this is structural, not technical. Network monitoring stacks — SIEM, NDR, NetFlow exporters — are tuned to watch traffic between devices, not the posture of the devices themselves. A router that quietly opens a GRE tunnel to a legacy host looks, to most telemetry, like just another link in the graph. The malware’s alternating-hours schedule and its syslog suppression are both aimed squarely at these blind spots: they make the abnormal look like downtime, and the missing logs look like a logging bug.
That is why Sygnia’s hunting guidance matters more than its IoCs. Signatures age; the underlying tactic — hide a collection point inside infrastructure the SOC already trusts — does not. Teams that add “unexplained tunnel interface” and “silent syslog on a routing device” to their detection playbooks will catch the next variant of this, even when the IoCs change. The IoCs are the map; the playbook is the compass.
Verdict
If you operate Cisco IOS XR routers or TACACS servers, start by auditing active tunnel and GRE interfaces against the configuration history, and deploy the IoCs and YARA rules Sygnia published. An off-config tunnel interface should trigger an immediate incident response, not a tier-2 ticket.
If you design the segmentation of a high-value network, assume the management gear — routers, authentication servers, admin hosts — is the first target of a Fire Ant-class actor. Defense does not stop at the perimeter: it includes the ability to detect a router that has become a sensor, and to stop trusting logs an attacker can filter.