Nation-StateThe Hacker News·5 hours ago
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
The China-linked Fire Ant group has expanded its espionage campaign to target Cisco IOS XR routers, TACACS servers, and Linux management hosts used for network routing and authentication. By compromising these infrastructure components, the actor gains the ability to steal credentials and disable security logging, allowing persistent access to high-value networks. This represents a significant escalation from the group's previous focus on VMware hypervisors.