China-Linked Group Compromises Cisco Routers in Cyberespionage Operation

A China-linked cyberespionage group, known as Fire Ant, has compromised Cisco routers and used them to monitor network traffic and search for access to other high-value networks. According to cybersecurity firm Sygnia, the group installed malware on the routers, which allowed it to remain undetected by network administrators.

The investigation began after researchers discovered a hidden network tunnel operating through a Cisco router. Sygnia found that the malware could suppress some router logs and change the information shown to administrators, making it difficult for them to detect the hackers' activity.

Fire Ant also collected network traffic passing through several compromised Cisco routers and sent the captured data to external servers. In some cases, the hackers used legitimate administrator accounts, making their activity appear like normal network operations.