Fire Ant Expands Network Infrastructure Targets to Collect Sensitive Data

A China-linked cyber espionage group has expanded its targeting of network infrastructure beyond VMware environments. The group, tracked by Sygnia as Fire Ant, compromised Cisco IOS XR routers in 2026 to collect network traffic while suppressing evidence of its activity.

The attackers also compromised TACACS authentication infrastructure and Linux management hosts, exploring access to connected high-value environments. This creates a potential 'target behind the target' scenario, where access to one organization's trusted infrastructure could expose paths toward other high-value environments.

Sygnia found attempts to suppress logging and conceal configuration activity on affected network equipment, while evidence was tampered with on compromised Linux systems. The firm described Fire Ant's operation as raising difficult questions for defenders about the reliability of systems producing evidence used to investigate attacks.