China-Linked Hackers Expand Targeting of Critical Network Infrastructure

A China-linked cyber espionage group has expanded its operations to target critical network and authentication infrastructure used by enterprises, according to new findings from incident response firm Sygnia.

The threat actor, tracked as Fire Ant, targeted Cisco IOS XR routers in 2026, using them to collect network traffic while suppressing evidence of its activity. The attackers also compromised TACACS authentication infrastructure and Linux management hosts as they explored access to connected high-value environments.

Sygnia found attempts to suppress logging and conceal configuration activity on affected network equipment, while evidence was also tampered with on compromised Linux systems.