Fire Ant campaign targets Cisco routers and TACACS servers
Image: Primary Incident-response firm Sygnia reported that the China-nexus actor it tracks as Fire Ant expanded a campaign to Cisco IOS XR routers, TACACS servers and Linux management hosts. Sygnia said compromised routers captured traffic, harvested credentials and suppressed logs and telemetry. The firm found a TACACS credential-collection toolset and router implants designed to hide tunnel configuration. It assessed strong overlap with UNC3886 reporting but did not make a conclusive attribution.
Sources
In this story
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
