FIRE ANT EVOLVES: FROM HYPERVISORS TO TRUSTED INFRASTRUCTURE

Summary from the TLDR InfoSec newsletter

The Fire Ant threat actor has escalated from hypervisor compromises to direct infection of network control planes via purpose-built IOS XR implants. These sophisticated router implants establish unauthorized GRE tunnels to legacy Linux hosts and actively suppress syslog alerts by injecting exclusion clauses into CLI outputs. On the authentication layer, the actor deploys a tool called TacTap to inject malicious libraries into the tac_plus process, ultimately harvesting credentials using a single-byte XOR key. Sygnia researchers assess that this activity strongly overlaps with the China-nexus UNC3886 cluster. To detect this activity, defenders must hunt for unexplained GRE interfaces, tac_plus process injections, and specific log-clearing commands across independent network and memory telemetry.