Fire Ant Trades Hypervisors for the Trust Layer: tac_plus Injection and Cisco Routers Turned Sniffers

The short version//

Yesterday we covered MikroTik's no-fix brute-force CVE — the threat model where your router gets owned from the outside. This one is worse, because it doesn't need to get in from the outside at all. Sygnia's updated Fire Ant report (blog Aug 27, press release Aug 30) shows a China-nexus actor that has stopped hunting hypervisors and started owning the layer other systems depend on: edge routers, TACACS+ servers, Linux jump hosts. The headline tricks: injecting a shared library into a running tac_plus process to harvest admin credentials, and turning Cisco IOS XR routers into covert sniffers that upload PCAPs to attacker-controlled FTP.

If you run routers daily — or you run OPNsense/pfSense with tac_plus for admin auth — this is your threat model made concrete.

What actually broke//

Fire Ant was first reported in 2025 as a hypervisor-level espionage actor. The 2026 activity, per Sygnia, expands the same strategy one layer down: instead of owning the platform that hosts workloads, own the systems that route traffic, authenticate administrators, and record what happened. Sygnia calls it the "target behind the target" — the compromised environment becomes a bridge into connected high-value networks, including critical infrastructure.

The actor's four-part operating model (Sygnia's framing): Control the infrastructure → Collect credentials and traffic → Build durable access → Conceal activity by making the evidence layer itself lie. That last one is the part that should make you uncomfortable.

TacTap: hooking accept() inside a running tac_plus//

The most technically interesting piece is Sygnia's tracking name TacTap, a two-component TACACS credential harvester:

• /usr/sbin/acppid — the injector. It locates the tac_plus process, checks whether its payload library is already mapped (via /proc/<pid>/maps), writes an embedded shared object to disk, injects it, and then deletes the on-disk library.
• /lib/libseconfd.so — the injected library. Once inside the running tac_plus, it PLT-hooks accept/accept4 so every newly accepted TACACS client connection passes through attacker code inside the service process itself. Accepted socket file descriptors are handed back to acppid over a local Unix socket at /var/run/acpid.lock using sendmsg-style fd passing.

The harvested credentials land in /var/log/.tacplus.acct, obfuscated with single-byte XOR, key 0xEF. That key choice is the fingerprint: Mandiant previously documented UNC3886 TACACS tooling that also XORed captured credential records with 0xEF before writing them to a log file.

Why does this beat ordinary credential theft? Because file-integrity checks pass. The injected library is deleted from disk after injection; the tac_plus binary on disk is pristine; and the whole thing lives in memory. Your integrity monitor sees a normal daemon. Meanwhile the authentication chokepoint — the box that authenticates users, authorizes commands, and records admin activity across your network devices — is quietly copying every credential as it's used. When the auth layer is compromised, you can no longer ask only "which account did this?" You have to ask whether the system recording that action can still be trusted.

The IOS XR router toolkit: your router now lies about itself//

The investigation started with an anomaly that should read like a horror story for network engineers: a GRE tunnel interface came up on a Cisco IOS XR router with no corresponding running-config or commit history to explain it. Operational state and configuration had decoupled — the device's own view of itself was no longer trustworthy.

What Sygnia recovered from the compromised routers, in plain English:

• Persistence that hides in plain sight: a boot script at /etc/rc.d/init.d/grub-rommon masquerading as a legitimate service monitors and launches an implant at /usr/bin/acpid — but only during odd-numbered hours; it stops the implant during even hours. Routine inspection at the wrong hour sees nothing running.
• Syslog suppression: acpid embeds a modified IOS XR syslog library. Log delivery is routed through a custom wrapper that checks for the string "Health" before forwarding — messages without it get a success-looking return value and are simply dropped. Your router's logs aren't missing; they were selectively eaten.
• Output filtering: a component at /pkg/bin/hd modified the IOS XR command execution path to append an IOS-style | exclude filter to show commands before they reach the shell — so tunnel-related config (tunnel interface, VRF, source/destination) can be filtered right out of what admins see. Sygnia also found repeated show ... | exclude history entries matching exactly those tunnel elements.
• Outbound comms: /pkg/bin/dhcpd_show_issu_status, masquerading as a DHCP status tool, contains Telnet client functionality and a hardcoded external C2 IP — built to operate from inside the router's native networking context (routing, VRF, RIB libraries) rather than standard Linux networking.
• Collection: PCAPs generated through legitimate router administration workflows using a legitimate admin account, uploaded from multiple routers to an external FTP server that had been installed the same day as the upload activity. The actor was picking vantage points across the environment, not one point of access.

For non-router people: a compromised edge router is worse than a compromised server because it can see everything crossing the network boundary — internal topology, management connections, auth flows, routing relationships. Endpoint collection sees one host. Router collection sees how your whole organization talks to each other.

BridgeAgent and the access layer//

The far end of that GRE tunnel was a legacy Linux box running BridgeAgent — a backdoor masquerading as zabbix_agent (note: the real Zabbix agent is zabbix_agentd; one letter off, deliberately). It persists via a zabbix_agent.service systemd unit running as root with auto-restart, renames its command line to look like /usr/bin/gnome-shell, stores its config encrypted at /opt/.ICEauthority (with the AES key embedded in the binary), polls over HTTPS on 443, and can launch a TLS reverse shell. From that box, Fire Ant probed connected high-value environments — SSH, HTTP/S, SMB/RPC, RDP — through the tunnel.

The broader Linux access layer was built to outlive detection: Medusa-rootkit artifacts under /usr/lib/locate, custom SSH backdoors named after real daemons (cupsdd ≈ cupsd, smartdd ≈ smartd), harvested SSH credentials in /var/log/remote.txt, and a REPTILE-like packet-triggered backdoor that was staged as /var/tmp/ping, renamed to masquerade under SentinelOne/Cybereason agent directories with timestomped timestamps — then deleted from disk while still running in memory. It activates on specific raw-packet markers (TCP dst 443/541/8443/10443, or UDP 40443→500) rather than a listening port, and its interactive PTY shell sets HISTFILE to null so .bash_history shows nothing.

Making the infrastructure lie//

The anti-forensics were surgical: login-history artifacts (wtmp, utmp, btmp) rewritten with sed to swap IP addresses; sudo lines stripped from /var/log/messages and /var/log/secure; SELinux disabled; AAA requests and SNMP traps suppressed. The investigation's core problem, in Sygnia's words: the environment may contain evidence, but the evidence sources may no longer be fully reliable. Logs have to be validated against memory, disk, network telemetry, auth records, config state — not assumed to be ground truth.

What you should do (hunting checklist)//

Sygnia's own hunting guidance, organized by asset class:

1. Routers: hunt for GRE/tunnel interfaces with no matching running-config or commit history; compare config state against show output (Sygnia's lead was exactly this mismatch); look for PCAP generation and FTP/SCP egress from router management accounts, command-accounting gaps, and traceroute/reachability testing to unusual external destinations.
2. TACACS+/AAA servers: inspect the memory map of your tac_plus process — /proc/<pid>/maps should show only expected shared objects; a stray .so (e.g., anything named like libseconfd.so) is the tell. Look for credential-like artifacts under log/tmp directories, and unexplained XOR-encoded files.
3. Linux jump/management hosts: deleted-but-running processes (ls -l /proc/<pid>/exe showing (deleted)), custom SSH listeners, SELinux disabling events, suspicious iptables NAT/port redirects (e.g., 22→443), /var/tmp staging, service names that imitate real daemons.
4. Security-agent masquerading: unexpected binaries under SentinelOne/Cybereason-style agent directories; agent-like processes spawning shells or Python; timestomped files matching nearby legitimate agent timestamps.

Published IOCs (SHA1, from Sygnia's sanitized IOC table):

File	SHA1	Role
/usr/sbin/acppid	36005f5e4398a1c62a2a9271eddfcc1b44b1ad00	TacTap injector targeting tac_plus
/lib/libseconfd.so	955cd45a2f6f226a2fdf44b329af1c8dde90cb38	TacTap injected library in tac_plus
/usr/bin/acpid	be6b27f429324a4af05a310d8ec9635e37c68a94	IOS XR implant (odd/even-hour)
/pkg/bin/hd	b149fa3a34bd585e7a674a4fd9538437bd06f514	IOS XR output-filtering component
/etc/rc.d/init.d/grub-rommon	6ef7d2985edf743ebff413a9298a127e9475d72f	Masqueraded persistence script

Sygnia also published four YARA rules in the report — FIREANT_BridgeAgent_Backdoor, FIREANT_BridgeAgent_Systemd_Unit, FIREANT_TACTAP_LIBSECONFD_1, and FIREANT_TACTAP_ACPPID_1 — worth dropping into your scanner if you run Linux management hosts.