Fire Ant Targets Cisco Routers in China-Linked Cyberespionage Operation

A China-linked cyber group known as Fire Ant has been targeting Cisco routers, compromising their security and using them to monitor network traffic and search for access to other important networks.

According to cybersecurity firm Sygnia, which investigated the group's activities, Fire Ant installed malware on affected devices that allowed hackers to remain undetected.

The malware also enabled the collection of network traffic passing through compromised Cisco routers and sent captured data to external servers. In some cases, hackers used legitimate administrator accounts to make their activity appear like normal network operations.

Sygnia discovered a hidden network tunnel operating through a Cisco router, which led to an investigation that revealed the presence of malware capable of suppressing some router logs and changing information shown to administrators.