Chinese Cyber Group Hijacks Cisco Routers for Espionage

A sophisticated Chinese-linked cyber espionage group has compromised Cisco routers and other trusted network infrastructure to conduct long-term surveillance and steal credentials, potentially gaining access to high-value networks and critical infrastructure, according to a report from cybersecurity firm Sygnia. The campaign, tracked as Fire Ant, represents a significant evolution in the group's tactics, moving beyond targeting individual servers to hijacking the core devices that manage and authenticate network traffic.

The investigation began after Sygnia researchers identified an anomaly on a Cisco IOS XR router: a Generic Routing Encapsulation (GRE) tunnel interface was active, but no corresponding configuration or commit history could explain its creation. This discrepancy indicated that the device's operational state could no longer be trusted to match the records visible to administrators. "The significance extended beyond the initially compromised environment, as the affected infrastructure could provide a path toward other connected high-value environments," said Asaf Perlman, director of incident response at Sygnia.

Once inside, the attackers deployed purpose-built...