decrypted · 1 september 2026 · ransomware and cybercrime · vulnerabilities and patching · supply chain

The espionage group that taught routers to hide their own tracks

A China-linked espionage group called Fire Ant has spent recent months turning the least glamorous parts of a network, Cisco routers, TACACS+ authentication servers, Linux jump boxes, into listening posts, and it did so largely by getting those devices to lie about their own logs. Sygnia published its investigation this week, and the detail worth sitting with isn't the espionage itself, it's how ordinary the compromised kit was.

Teaching a router to forget

Fire Ant first made its name in 2025 burrowing into VMware ESXi and vCenter. Sygnia's new findings show it has expanded into the infrastructure that sits around those servers: Cisco IOS XR routers, the TACACS+ servers that authenticate network administrators, and the Linux hosts used to manage them. Once inside, Fire Ant didn't just plant a backdoor and hope nobody looked. It rewrote the layer that would tell an administrator something was wrong: modifying system libraries so log messages showed only routine health checks, hiding GRE tunnel configurations from the running config, and disabling SELinux. On the TACACS+ server it used a credential-collection toolset called TacTap, with an injector named acppid that loaded a malicious library straight into the running authentication process to capture passwords as they passed through, writing them to a hidden file lightly obfuscated with a single-byte XOR key. A backdoor called BridgeAgent disguised itself as the Zabbix monitoring agent that network teams already trust to be running.

That's the analogy worth keeping for a non-technical reader: this isn't a burglar avoiding the cameras, it's a burglar who gets into the control room, edits the tape, and leaves the "all quiet" light on. Sygnia found evidence Fire Ant used its footholds to probe toward higher-value environments, including infrastructure it describes as critical, though confirmed compromise there was limited to scanning and connection attempts rather than full access.

The Secure by Design lesson

The design flaw here isn't a single CVE, it's an architectural habit: treating network devices as plumbing rather than endpoints, and trusting the logs a device produces about itself. If a router, switch or TACACS+ server can be told what to log, an attacker with administrative access can tell it to log nothing interesting. Secure by Design for this class of kit means telemetry that leaves the device immediately, to a store the device has no ability to write to or delete from, and separating the management plane, the network used to administer routers and switches, from the production traffic those devices carry. UK organisations running Cisco IOS XR estates or TACACS+ for network admin authentication, a good slice of enterprise and public sector networks, should treat this as a prompt to check whether their monitoring would actually catch a device lying to them, rather than just a device going quiet.

Also this week

A vulnerability in the WPMU DEV Dashboard plugin, used to manage roughly 350,000 WordPress sites from a central hub, let an unauthenticated attacker become a site administrator. The flaw, CVE-2026-76581, CVSS 9.8, sat in how the plugin's single sign-on process validated a cryptographic signature: an unauthenticated first step could be tricked into signing a token that a second step would then accept in a different context, effectively using the login process as a signature-generating oracle against itself. WPMU DEV patched it on 24 August. It's a reminder that a single trusted management hub is also a single point of failure for every site plugged into it, the same supply-chain trade-off UK organisations make whenever they centralise WordPress administration through a third party.

Qilin, a ransomware crew running the familiar steal-then-encrypt playbook, listed Absolute Consultancy Services, a UK professional services firm, on its leak site on 30 August. As with any leak site posting, this is a claim made by the criminals rather than a confirmed breach, and we've seen no independent confirmation of what, if anything, was taken. It's worth a line here mainly as an annual reminder that a firm doesn't need to be a household name to be worth a ransomware crew's time.

Sources

If your organisation runs Cisco network infrastructure or TACACS+ authentication and wants a second opinion on whether your logging would catch this, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.