Fire Ant Trades Hypervisors for the Trust Layer: tac_plus Injection and Cisco Routers Turned Sniffers
Sygnia's Fire Ant update shows a China-nexus actor PLT-hooking accept() inside a running tac_plus process to harvest admin credentials, while turning Cisco IOS XR routers into covert PCAP collectors.