When the Router Lies to the SOC
Fire Ant turned IOS XR routers, TACACS servers, and Linux management hosts into a covert access layer that corrupted forensic evidence.
Network incident response assumes that a router can describe its own state. Investigators inspect the running configuration, commit history, command accounting, interface state, and syslog output, then reconcile those records into a timeline. Fire Ant broke that assumption by compromising the infrastructure that produced the evidence.
Sygnia’s 2026 investigation found purpose-built malware on Cisco IOS XR routers, a credential-collection implant inside a TACACS server, and layered backdoors across Linux management hosts. The actor suppressed router logs, filtered command output, captured traffic, intercepted authentication sessions, and kept access paths outside normal endpoint visibility.
The report does not identify the initial router access vector, a supporting CVE, or a conclusive attribution to UNC3886. Those limits matter. The defensive value comes from the observed mechanics and the resulting forensic problem: once the control plane and evidence plane are both compromised, the device cannot be its own source of truth.
The Investigation Started With a Contradiction#
The first high-value signal was an operational GRE tunnel on an IOS XR router. The interface was associated with a VRF and passed traffic, but the visible running configuration and commit history did not explain its creation. A normal configuration review therefore returned a clean answer while the data plane exposed a conflicting state.
That contradiction changed the investigation. A missing configuration line can result from collection error or ordinary operational drift. A live interface with no corresponding history, combined with later evidence of command filtering and telemetry suppression, means the collection mechanism itself must be treated as potentially hostile.
The correct question is no longer whether a suspicious object appears in one command. It is whether independent sources agree that the object exists, how it was created, which process controls it, and where its traffic terminates.
| Evidence source | Expected authority | Fire Ant failure mode | Independent validation |
|---|---|---|---|
| Running configuration | Current intended state | Tunnel-related lines hidden from CLI output | Interface counters, forwarding state, peer telemetry |
| Commit history | Change provenance | Commit activity suppressed or obscured | Central configuration archive and administrator records |
| Local syslog | Device event history | Messages selectively dropped | Remote collectors, network taps, and neighboring devices |
| AAA accounting | Administrative attribution | TACACS path intercepted and records weakened | Identity logs, session recording, and privileged access gateway |
| Process inventory | Runtime execution | Malware used trusted names and intermittent execution | Memory maps, core files, hashes, and external process telemetry |
The IOS XR Toolkit Rewrote the Evidence Layer#
The recovered router tooling was built for IOS XR rather than copied from a generic Linux host. Its components interacted with logging, shell command dispatch, routing, VRF resolution, AAA, and Telnet-management functions. That distinction gave the actor control over the interfaces administrators use to understand the router.
Persistence used /etc/rc.d/init.d/grub-rommon, a boot-themed script masquerading as a legitimate service. It monitored an implant stored at /usr/bin/acpid and ran it during odd-numbered hours while stopping it during even-numbered hours. Intermittent execution reduced the chance that a short process inspection would catch it.
The acpid component embedded a modified IOS XR syslog library. Its wrapper checked outgoing messages for the string Health; messages that failed the check received a success-like return without being forwarded through mq_send. Another component at /pkg/bin/hd modified the command path so that show commands received an appended | exclude filter before reaching the normal shell_send_cmd() routine. Command history contained filters matching the tunnel interface, VRF, source, and destination fields.
flowchart TD
A["Administrator runs show command"] --> B["IOS XR command dispatcher"]
B --> C["Compromised hd component"]
C --> D["Append exclude filter"]
D --> E["Normal shell_send_cmd"]
E --> F["Incomplete CLI output"]
G["Router event"] --> H["Modified evsyslog wrapper"]
H --> I{"Contains Health"}
I -->|Yes| J["Forward with mq_send"]
I -->|No| K["Return apparent success"]
J --> L["Visible syslog"]
K --> M["Missing evidence"]
F --> N["False clean state"]
M --> N
The router also became a collection platform. Fire Ant generated PCAPs from several router interfaces and uploaded them to external FTP infrastructure using a legitimate administrative account. Router-level capture exposes topology, management sessions, authentication flows, and relationships between connected networks from a broader vantage point than a compromised endpoint.
The GRE Tunnel Led to BridgeAgent#
Tracing the far side of the unexplained GRE tunnel led to a legacy Linux system. The host was not a passive endpoint. Logs showed repeated connection attempts toward administrative and service ports in connected high-value environments, including SSH, HTTP, HTTPS, SMB, RPC, and RDP.
The system contained zabbix_agent, a binary named to resemble the legitimate zabbix_agentd monitoring daemon. Sygnia named the implant BridgeAgent. It persisted through zabbix_agent.service, ran as root with automatic restart behavior, changed its apparent command line to /usr/bin/gnome-shell, and loaded encrypted configuration from /opt/.ICEauthority.
BridgeAgent periodically polled a controller over HTTPS and supported an outbound TLS reverse shell. Recovered journal data showed it starting a secondary binary named ntfsfixed. The host therefore served as a controlled bridge between external infrastructure, the GRE-connected router, and networks reachable through the compromised trust relationship.
flowchart TD
A["External controller"] -->|HTTPS polling| B["BridgeAgent"]
subgraph Linux["Legacy Linux management host"]
C["zabbix_agent.service"] --> B
D["Encrypted .ICEauthority"] --> B
B --> E["TLS reverse shell"]
B --> F["ntfsfixed child process"]
E --> G["Reconnaissance tools"]
end
G --> H["GRE tunnel"]
H --> I["Compromised IOS XR router"]
I --> J["Connected high-value network"]
I --> K["Router PCAP collection"]
K --> L["External FTP infrastructure"]
This design creates two investigation traps. The first is role confusion: a monitoring-looking process on a management host receives less scrutiny because its name fits the environment. The second is scope compression: treating the Linux host as the final victim misses the router and every network reachable through the tunnel.
TacTap Sat Inside the Authentication Path#
Fire Ant also compromised the TACACS server, the system responsible for authenticating administrators, authorizing commands, and recording activity across network devices. Investigators found a VMCI-socket backdoor under /var/tmp/audit, providing an access path through VMware VSOCK that would not necessarily appear as a conventional guest network login.
The credential collector, named TacTap by Sygnia, consisted of /usr/sbin/acppid and /lib/libseconfd.so. The first component located the tac_plus process, wrote or maintained the shared object, injected it, and removed the library from disk. The injected library hooked accept and accept4 inside the authentication daemon.
When tac_plus accepted a connection, the hook passed the live file descriptor to acppid over the Unix socket /var/run/acpid.lock using sendmsg-style descriptor passing. Captured credential material was stored at /var/log/.tacplus.acct and obfuscated with the single-byte XOR key 0xEF.
sequenceDiagram
participant R as IOS XR router
participant T as tac_plus
participant L as libseconfd.so
participant A as acppid
participant F as Credential artifact
A->>T: Locate running daemon
A->>T: Inject libseconfd.so
A->>A: Remove library from disk
R->>T: Open TACACS session
T->>L: accept or accept4 executes
L->>L: Intercept accepted socket
L->>A: Pass file descriptor over acpid.lock
A->>A: Process session material
A->>F: Write XOR 0xEF data
This is more damaging than stealing a static password database. The implant occupied the live authentication path and observed sessions as they arrived. Any response that trusts the same TACACS accounting records to distinguish legitimate administrator activity from attacker activity inherits the compromise.
Persistence Extended Beyond One Implant#
The Linux access layer included Medusa-related components, custom SSH backdoors, reverse-tunneling tools, and a packet-triggered backdoor with REPTILE-like behavior. Some artifacts had been placed in 2025 and remained useful during hands-on activity in 2026. Removing one binary did not remove the access architecture.
Names such as /usr/sbin/cupsdd and /usr/sbin/smartdd imitated cupsd and smartd. Another payload was moved into paths associated with SentinelOne or Cybereason and timestomped to resemble nearby security-agent files. Its executable was deleted while the process remained active in memory, defeating disk-only triage.
The recovered packet-triggered implant inspected raw Layer 2 traffic and activated only after matching embedded markers. It monitored selected TCP, UDP, and ICMP traffic rather than exposing a continuously listening service. The malware also created an interactive PTY, cleared HISTFILE, modified iptables behavior, redirected selected inbound SSH traffic, and enabled IPv4 forwarding.
| Layer | Mechanism | Defensive consequence |
|---|---|---|
| Router | CLI filtering and syslog suppression | Local administrative evidence becomes incomplete |
| Tunnel | GRE path through management infrastructure | Segmentation assumptions no longer describe reachability |
| Authentication | Injection into tac_plus | Credentials and command attribution become suspect |
| Linux persistence | Services, SSH backdoors, and rootkit components | Removing one implant does not close all access paths |
| Memory | Deleted-but-running security-agent masquerade | File scans can report clean while execution continues |
| Network trigger | Raw packet inspection with activation markers | No stable listening port is required |
Detection Must Start With Asset Role#
Atomic indicators are useful for scoping, but the durable analytic is behavioral. A router should not create unexplained GRE state, export PCAPs to a new FTP destination, initiate unusual traceroutes, or return output that disagrees with independent forwarding observations. A TACACS daemon should not map an unapproved shared object or pass accepted sockets to an unrelated local process.
On Linux management hosts, high-signal combinations include a monitoring or security-agent process spawning shells, Python, SCP, or tunneling utilities; root services using unexpected executable names; unexplained GRE interfaces; SELinux weakening; /var/tmp staging; and processes whose /proc/<pid>/exe target has been deleted.
The following script collects these Linux-side signals without changing host state. It is intended for an isolated forensic copy or a live host under an approved incident-response procedure.
#!/usr/bin/env bash
set -euo pipefail
output_dir="${1:-fire-ant-triage-$(date -u +%Y%m%dT%H%M%SZ)}"
mkdir -p "$output_dir"
date -u +%FT%TZ > "$output_dir/collection-time.txt"
uname -a > "$output_dir/uname.txt"
ip -details link show > "$output_dir/ip-link.txt"
ip -details tunnel show > "$output_dir/ip-tunnels.txt" 2>&1 || true
ip rule show > "$output_dir/ip-rules.txt"
ip route show table all > "$output_dir/ip-routes.txt"
iptables-save > "$output_dir/iptables.txt" 2>&1 || true
systemctl list-units --type=service --all > "$output_dir/services.txt"
systemctl cat zabbix_agent.service > "$output_dir/zabbix-agent-service.txt" 2>&1 || true
ps -eo pid,ppid,lstart,user,args --forest > "$output_dir/processes.txt"
ss -plantu > "$output_dir/sockets.txt"
find /proc/[0-9]*/exe -lname '* (deleted)' -printf '%p -> %l\n' \
> "$output_dir/deleted-executables.txt" 2>/dev/null || true
find /var/tmp /usr/sbin /usr/lib /opt -xdev -type f \
-printf '%T@ %m %u %g %s %p\n' 2>/dev/null \
| sort -n > "$output_dir/file-timeline.txt"
journalctl --utc --no-pager > "$output_dir/journal.txt"
tar -czf "${output_dir}.tar.gz" "$output_dir"
sha256sum "${output_dir}.tar.gz" > "${output_dir}.tar.gz.sha256"The output is not a clean bill of health. A rootkit can tamper with user-space views, and the host may already be an unreliable collector. Compare the archive with EDR telemetry, hypervisor evidence, packet captures, remote logs, configuration backups, and memory acquisition performed through a trusted method.
Build an Independent Evidence Graph#
Traditional triage asks each asset what happened to it. Infrastructure compromise requires asking neighboring systems what they observed about the asset. A router interface should be visible in traffic counters and peers. An administrator session should appear in identity, privileged access, TACACS, router, and endpoint telemetry. A process should be supported by memory mappings, file metadata, service configuration, and network behavior.
The goal is not perfect agreement. The goal is to make disagreement explicit and investigative. A missing local event paired with a remote flow, a PCAP transfer without command accounting, or a live socket without a trusted process explanation is evidence, not merely missing data.
flowchart TD
A["Suspected infrastructure asset"] --> B["Local configuration"]
A --> C["Runtime and memory"]
A --> D["Remote telemetry"]
A --> E["Identity and AAA"]
A --> F["Neighbor observations"]
B --> G["Normalize time and object IDs"]
C --> G
D --> G
E --> G
F --> G
G --> H{"Sources agree"}
H -->|Yes| I["Build supported timeline"]
H -->|No| J["Record contradiction"]
J --> K["Acquire volatile evidence"]
J --> L["Expand scope by trust path"]
K --> M["Reconstruct from independent sources"]
L --> M
For this case, an investigation should scope every router sharing management paths, TACACS clients and servers, virtualization hosts supporting AAA infrastructure, Linux jump hosts, configuration-management systems, remote logging destinations, and networks reachable through anomalous tunnels. The trust relationship defines the blast radius more accurately than the first compromised hostname.
Preserve Volatile State Before Rebooting#
Cisco’s IOS XR forensic guidance explicitly warns against rebooting a suspected device during initial assessment. A reboot irrecoverably removes volatile evidence including RAM, ARP and routing state, NAT translations, and ACL counters. Cisco also recommends isolating the device before examination so an adversary cannot unload implants remotely or observe investigator commands.
The vendor procedure collects show tech-support, version and socket state, active packages, platform state, logging, running configuration, filesystem listings, command history, process data, and platform integrity information. It then uses Cisco’s forensic collection script or a manual process-enumeration workflow before obtaining core files from anomalous processes.
Isolation requires operational planning. Pulling a production edge router without a prepared failover can create an outage and destroy the network path needed for collection. The response plan should predefine alternate routing, out-of-band administration, evidence storage, authorized Cisco TAC engagement, and the decision authority for core acquisition.
| Response action | Evidence benefit | Operational risk |
|---|---|---|
| Isolate through prepared failover | Stops actor observation and remote implant control | Routing convergence or service interruption |
| Preserve RAM and process cores | Retains deleted implants and modified libraries | Sensitive data exposure and device load |
| Export configuration and history | Captures the view presented to administrators | Output may already be filtered |
| Collect remote flow and syslog | Provides independent chronology | Retention may be incomplete |
| Rotate infrastructure credentials | Removes harvested access material | Can break automation and emergency access |
| Reimage from trusted media | Restores a known software baseline | Erases residual evidence if performed too early |
Hardening the Trust Layer#
The first control is inventory. Routers, AAA servers, hypervisors, jump hosts, and management appliances must be owned as security assets with supported versions, known administrators, configuration baselines, telemetry destinations, and tested acquisition procedures. Devices without EDR require stronger external observation, not an exemption from monitoring.
Cisco recommends separating the management, control, and data planes, restricting management-plane access, using centralized AAA, sending logs to a remote collector, and protecting transport. Current IOS XR guidance also recommends TACACS+ over TLS 1.3 where both the platform and AAA server support it. Encryption protects traffic in transit, but it does not protect credentials after malicious code executes inside tac_plus, so server integrity remains a separate control.
Configuration management should continuously compare intended state with collected state and observed network behavior. A tunnel absent from the configuration archive but visible in flow telemetry should produce an integrity incident. Remote command accounting, immutable log retention, and privileged session recording reduce dependence on the device being administered.
Finally, recovery must assume multiple access paths. Reimage affected infrastructure from trusted media, rotate network-administrator and service credentials, replace keys available to compromised management hosts, validate connected environments, and monitor for re-entry. Removing BridgeAgent while leaving TACACS credentials or a packet-triggered backdoor intact is not containment.
What Is Confirmed and What Is Not#
Sygnia observed Fire Ant activity continuing into 2026 and assessed strong overlap with public reporting on UNC3886. That overlap includes router-focused operations, TACACS credential collection, Medusa-related tooling, custom SSH access, and deliberate telemetry suppression. Sygnia did not make a conclusive attribution, so the two names should not be presented as interchangeable.
The published investigation does not establish how Fire Ant first gained access to the IOS XR router. No specific vulnerability should be attached to that step without additional evidence. The report documents one investigated environment and cannot establish the complete victim population or every variation of the toolkit.
The strongest conclusions are narrower and more useful. Fire Ant operated from trusted infrastructure, altered evidence at its source, captured administrative authentication material, and used layered access mechanisms across routers and Linux systems. Those observations are sufficient to change how defenders collect and validate infrastructure evidence.
Conclusion#
Fire Ant turned routing, authentication, management, and logging systems into one connected access layer. The strategic advantage was not only persistence. Control of those systems gave the actor reach into connected environments, visibility into privileged traffic, and influence over the records investigators would later inspect.
The defensive response is to remove single-source trust. Router output must be checked against forwarding behavior and external telemetry. TACACS records must be checked against identity and session evidence. Disk state must be checked against memory. Every contradiction should expand the investigation along the trust path that produced it.
When the infrastructure responsible for proving what happened is compromised, collecting more output from that same infrastructure does not restore confidence. Independent evidence does.
References#
Fire Ant Evolves From Hypervisors to Trusted Infrastructure
Cisco IOS XR Software Forensic Data Collection Procedures