Routers rarely get attention. They sit in racks, push traffic, and run untouched for years at a time. That quiet reliability is exactly what Fire Ant hackers learned to exploit, because a compromised router watches everything and raises no alarm. Investigators recently unpicked a Chinese espionage operation that turned Cisco networking gear into long-term surveillance equipment. The group has moved on from virtualisation platforms, and it now hunts the plumbing that holds entire organisations together.
A tunnel that should not have existed
The case started with a small inconsistency. On a Cisco IOS XR router, responders spotted an active GRE tunnel interface. GRE, short for Generic Routing Encapsulation, wraps traffic so it can travel privately between two points across another network. Nothing in the router’s running configuration explained that tunnel, and the commit history held no record of anyone building it.
That single anomaly cracked open the wider intrusion. Researchers at incident response firm Sygnia traced the activity back to Fire Ant, a group that had switched its focus from VMware hypervisors to Cisco routers, TACACS authentication servers, and Linux management hosts. Each of those targets carries a lot of trust and very little scrutiny.
How Fire Ant hackers hid inside network gear
Fire Ant hackers deployed custom malware on the compromised devices, then buried it behind a fake system service. The implant only ran during alternating hours, which kept its footprint intermittent and awkward to catch. It also suppressed specific syslog messages, so administrators reviewing their logs never saw entries tied to the hidden tunnel. Beyond that, the malware opened outbound Telnet connections to attacker infrastructure and offered interactive shell access with no logging at all.
Log tampering ran deeper still. The operators edited system records and altered file timestamps to strip out the evidence investigators depend on. Because of that habit, logs pulled from compromised infrastructure cannot stand on their own and need checking against other sources.
The router becomes a collection platform
Administrative access opened a far more valuable door. Fire Ant hackers captured live traffic from multiple routers, saved it as PCAP files, and uploaded those files to external FTP servers. Such captures can expose internal topology, administrative sessions, authentication flows, routing relationships, and traffic exchanged with connected partners.
The investigating team described the change bluntly, writing that the behaviour “shifts the router’s role from a transit device to a collection platform.” Once the group held control, the device gave them a fixed vantage point over traffic crossing trusted network paths. A box built to forward data had quietly started harvesting it instead.
Target behind the target
The concealed GRE tunnel connected one compromised router to a legacy Linux server. Fire Ant hackers used that machine for staging and reconnaissance, then probed systems sitting in connected environments. Their scans concentrated on ports tied to SSH, web services, SMB/RPC, and RDP, and some of the systems they reached relate to critical infrastructure.
Investigators call this approach “target behind the target.” The attackers breach one organisation’s trusted infrastructure, then travel along its legitimate connections toward networks they could never reach directly. It works because those links exist for good reasons, so nobody questions traffic flowing across them.
BridgeAgent, a backdoor dressed as a monitoring tool
Researchers also documented a previously unknown backdoor called BridgeAgent. It imitates a legitimate Zabbix monitoring agent, which helps it blend into environments where such software looks perfectly ordinary. The backdoor persists as a root-level systemd service, supports TLS reverse shells, and runs additional payloads on command.
Analysts note strong overlap between Fire Ant hackers and UNC3886, another Chinese espionage group documented previously. However, filenames, paths, and implementation details differ enough that the two are not treated as identical.
Why router-level spying matters to everyone
Most security advice covers accounts, devices, and passwords. Very little of it covers the router, and that gap is precisely where this campaign lives. When attackers own the network layer, they learn who talks to whom, when, and along which path. They rarely need to break into individual machines, because the traffic itself tells the story.
Home and small office routers face a smaller version of the same problem. Many run for years without a firmware update, keep their factory credentials, and never get inspected. Attackers know it, so consumer gear keeps appearing in botnets, proxy networks, and espionage relays.
Practical steps worth taking
- Update your router firmware regularly, and retire hardware the vendor has stopped supporting.
- Replace default admin credentials, then switch off remote management unless you genuinely rely on it.
- Disable legacy services such as Telnet, since they send information in readable form.
- Encrypt your traffic with a trusted VPN, so anyone capturing packets along the route collects ciphertext rather than usable sessions.
- Review your router settings occasionally for changes you did not make.
Final Thoughts
Network devices earn trust by being boring, and Fire Ant hackers built a campaign on that assumption. Their tools hid inside normal services, edited the logs meant to catch them, and turned routers into listening posts aimed at partner networks. Defenders now have indicators of compromise, hunting queries, and YARA rules to work with, which helps considerably. Still, the broader lesson holds for everyone: the device moving your traffic deserves the same attention as the device creating it, and encryption remains your best insurance when the path itself cannot be trusted.
