China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

Summary

A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks. Sygnia, the incident response firm that investigated the intrusion, said the actor

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.