China-Linked Fire Ant Group Compromises Cisco Routers

A China-linked cyberespionage group has been compromising Cisco routers to monitor network traffic and search for access to other high-value networks, according to cybersecurity firm Sygnia.

The group, called Fire Ant, targets Cisco routers running IOS XR and installs malware designed to operate on these devices. This malware is capable of suppressing some router logs and changing the information shown to administrators, making it difficult to detect their activity.

Sygnia's investigation began after researchers discovered a hidden network tunnel operating through a Cisco router that was not visible in the normal configuration records. The company found evidence of scanning and connection attempts to other high-value networks, including critical infrastructure, but did not confirm whether these additional systems were successfully breached.