China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs Swati KhandelwalAug 31, 2026Cyber Espionage / Network Security A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks. Sygnia, the incident response firm that investigated the intrusion, said the actor turned the compromised routers into collection platforms, capturing network traffic, harvesting credentials, and suppressing the logging and telemetry that defenders rely on to reconstruct an attack. The firm assessed that the hacker group used its foothold to explore paths to connected high-value environments, including critical…