Full Report
The researchers discovered Fire Ant's new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history. [...]
Analysis Summary
# Threat Actor: Fire Ant
## Attribution & Identity
* **Actor Identification:** Fire Ant
* **Aliases:** Strongly overlaps with **UNC3886**.
* **Known Associations:** Identified as a Chinese espionage group. While closely related to UNC3886, researchers noted distinct differences in filenames, paths, and implementation details.
## Activity Summary
Fire Ant has shifted its operational focus from targeting VMware hypervisors to compromising core networking infrastructure, specifically Cisco routers, TACACS authentication servers, and Linux management hosts. The actor utilizes a "target behind the target" strategy, where they compromise a trusted organization to use its infrastructure as a covert bridge to access high-value connected networks (e.g., critical infrastructure).
## Tactics, Techniques & Procedures
* **Infrastructure Manipulation:** Creating active GRE (Generic Routing Encapsulation) tunnels on Cisco IOS XR routers that do not appear in running configurations or commit histories.
* **Persistence:** Deploying custom malware disguised as fake system services; implants may run on alternating hours to evade detection.
* **Log Evasion:** Selective suppression of syslog messages to hide tunnel-related data and tampering with file timestamps (timestomping) to obscure forensic evidence.
* **Traffic Collection:** Capturing router traffic (PCAP files) and exfiltrating them to external FTP servers to map internal topologies and intercept authentication flows.
* **Lateral Movement:** Establishing outbound Telnet connections for interactive shell access without logging; using reverse TLS shells via compromised Linux hosts.
* **Masquerading:** Disguising backdoors as legitimate monitoring tools (e.g., Zabbix agents).
* **MITRE ATT&CK IDs (Inferred):**
* T1071.001 (Application Layer Protocol: Web Protocols)
* T1572 (Protocol Tunneling - GRE)
* T1098 (Account Manipulation)
* T1562.001 (Impair Defenses: Disable or Modify Tools)
* T1070.006 (Indicator Removal: Timestomp)
* T1020 (Automated Exfiltration)
## Targeting
* **Sectors:** Critical Infrastructure, Technology (Network Administration), and high-value environments connected to initial victims.
* **Geography:** Primarily targets regions of interest to Chinese state intelligence (Global espionage).
* **Victims:** Users of Cisco IOS XR routers, TACACS servers, and Zabbix monitoring software.
## Tools & Infrastructure
* **Malware:**
* **BridgeAgent:** A previously undocumented backdoor disguised as a Zabbix monitoring agent, persisting as a root-level systemd service.
* Custom Cisco IOS XR implants.
* **Infrastructure:**
* **GRE Tunnels:** Used to bridge compromised routers to legacy Linux staging servers.
* **C2/Exfiltration:** External FTP servers for PCAP exfiltration; outbound Telnet/SSH.
* **Protocols:** TLS-encrypted reverse shells.
## Implications
Fire Ant represents a sophisticated tier of espionage that targets the "trusted path." By moving from the application layer (hypervisors) to the routing layer (Cisco IOS XR), they achieve a level of invisibility where the router acts as a collection platform rather than just a transit device. Their ability to modify router behavior without changing the stored configuration makes standard integrity checks insufficient, posing a significant threat to organizations managing interconnected partner networks or critical infrastructure.
## Mitigations
* **Out-of-Band Log Validation:** Validate logs retrieved from networking equipment against external logging servers, as local logs may be tampered with.
* **Configuration Auditing:** Periodically audit active interfaces and routing tables (e.g., `show interfaces brief`) against the committed `running-config` to identify unauthorized GRE tunnels.
* **Host-Based Monitoring:** Implement YARA rules and integrity monitoring on Linux management hosts to detect unauthorized systemd services (like the BridgeAgent/Zabbix masquerade).
* **Traffic Analysis:** Monitor for unusual outbound Telnet or FTP traffic originating directly from core routers.
* **Hardening:** Ensure TACACS+ and other authentication servers are patched and monitored for credential harvesting attempts.