Fire Ant Turns Cisco Routers Into Spy Platforms

A China-linked threat actor known as Fire Ant has compromised Cisco IOS XR routers and other trusted infrastructure to spy on networks, steal credentials, maintain hidden access, and explore routes toward critical infrastructure.

Investigators discovered an unexplained GRE tunnel interface on a Cisco IOS XR router. The interface was active, but there was no matching configuration or commit history to explain how it had been created.

Fire Ant deployed several malicious components designed specifically for the IOS XR environment. One implant was placed in a startup path and disguised as a legitimate service. Another component launched during selected hours, allowing the malware to remain persistent while reducing the chance of being noticed during routine checks.