FIRE Ant, a China‑linked cyber espionage group, has been observed compromising Cisco IOS XR routers to harvest credentials and establish covert footholds inside victim networks. The intrusion was first detected in late August 2026 when analysts noticed an anomalous tunnel interface on a core router.
Researchers from Sygnia identified two pieces of bespoke malware, dubbed TacTap and BridgeAgent, that target Cisco IOS XR systems. The malware injects into router processes, subverts logging to hide its activity and silently extracts username‑password pairs from the local TACACS daemon.
The intrusion also planted deep backdoors on Linux‑based management servers, disguising them as legitimate system services to evade detection. A hidden tunnel interface on the compromised router provided the attackers with a reliable conduit for data exfiltration and lateral movement.
The activity has been tracked since late August 2026 and appears to be part of a broader shift by the group toward trusted infrastructure such as edge routers and authentication servers, a move noted in multiple security reports. No CVE has been assigned to the techniques used, reflecting the custom nature of the malware and the lack of a publicly disclosed vulnerability.
Network administrators should begin by reviewing router configurations for any unexpected tunnel interfaces or unexplained static routes, and by enabling strict logging of privileged command execution on IOS XR devices. They should also verify that TACACS+ servers are hardened with multi‑factor authentication and that access to the daemon is limited to known management hosts, while segmenting the control plane from user traffic to limit the impact of a compromised router.
Threat hunting teams can search for indicators such as unusual outbound connections from the router to unfamiliar IP addresses, the presence of the TacTap or BridgeAgent binaries in memory dumps, and anomalous authentication requests to TACACS servers. Updating detection rules accordingly and sharing findings with trusted peers helps improve collective defence against this persistent threat.