Nation-StateCybersecurity Dive·2 hours ago
State-linked actor targets Cisco routers for espionage
An actor known as Fire Ant has expanded its reach into trusted environments, with unique tooling and stealth.
← Back
Nation-StateSecurity Affairs·6 hours ago
China-linked Fire Ant Hides Inside Trusted Infrastructure
A Chinese-linked cyber espionage group designated Fire Ant has escalated its operations by compromising Cisco routers and other trusted network infrastructure to gain access to high-value targets. The attackers stole credentials and manipulated logs to conceal their activities while using the compromised infrastructure as a foothold to reach downstream networks. This shift from individual endpoint compromises to infrastructure-level attacks demonstrates an evolution in the group's operational sophistication and capability for persistent network access.
Read full article at Security Affairs ↗Related Articles
Nation-StateThe Hacker News·8 hours ago
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
The China-linked Fire Ant group has expanded its espionage campaign to target Cisco IOS XR routers, TACACS servers, and Linux management hosts used for network routing and authentication. By compromising these infrastructure components, the actor gains the ability to steal credentials and disable security logging, allowing persistent access to high-value networks. This represents a significant escalation from the group's previous focus on VMware hypervisors.
Nation-StateHelp Net Security·7 hours ago
Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails
Russian state-aligned hackers from UAC-0099 are embedding malicious prompts in malware to deliberately trigger AI safety guardrails and disrupt AI-assisted malware analysis tools, a technique ESET has dubbed GuardBreaker. The group, which conducts initial-access operations for the GRU-linked Sandworm, uses VBS scripts containing provocative prompts designed to overwhelm AI safety mechanisms and prevent proper analysis of their malicious code. This represents a new adversarial approach where threat actors actively work to subvert the security tools being used to detect their operations.
Nation-StateThe Hacker News·9 hours ago
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
The U.S. Department of Justice issued a correction to clarify that several federal agencies, including NASA, the Federal Reserve, the Department of Energy, and the DoJ itself, were targeted rather than victimized by Chinese threat actors. This revision followed an earlier press statement that had incorrectly characterized the nature and scope of the attacks. The distinction between being targeted versus successfully compromised carries significant implications for understanding the actual impact of the Chinese cyber operations.