China-linked Fire Ant hijacked Cisco routers to steal credentials and blind security logs

The China-linked cyber-espionage actor Fire Ant expanded its activity from VMware hypervisors to Cisco IOS XR routers, TACACS servers, and Linux management hosts. The actor used routers to collect traffic, steal credentials, and suppress logging and telemetry. Activity against critical-infrastructure networks was limited to scanning and connection attempts; no confirmed compromise was identified.