Technology newsroom
Alert! 🚨 Chinese Hackers 'Fire Ant' Compromise Cisco Routers, Steal Passwords, Delete Evidence
The Chinese-linked hacker group Fire Ant is expanding its attack targets to Cisco routers and critical servers, using specialized malware to steal data and erase traces of intrusion.
📌 Key Highlights:
- The Chinese-linked hacker group Fire Ant has expanded its attacks from VMware to Cisco IOS XR routers, TACACS servers, and Linux management hosts.
- The primary goals are to steal credentials and delete logs to cover up traces of the attack.
- Uses custom-built malware named "Slash" to compromise and embed itself in high-level network devices.
Sygnia, a cybersecurity incident response firm, has published an investigation report on intrusions by the Chinese government-linked hacker group "Fire Ant." The report reveals that the group has expanded its attack scope from previously focusing on VMware hypervisor systems to even more critical network infrastructure.
Fire Ant's new targets are high-value devices and systems within enterprise networks, including Cisco routers running IOS XR operating systems, Terminal Access Controller Access-Control System (TACACS) servers which perform authentication, and Linux management hosts. These devices are central to data routing, user authentication, and high-value network management. Gaining control over these systems effectively means taking over the entire network.
👾 "Slash" Malware: A Highly Dangerous Espionage Tool
Fire Ant has developed and deployed its custom-built malware named "Slash" for this attack. The malware is specifically designed to embed itself into Cisco IOS XR routers. Once successfully installed, it acts as a backdoor, allowing attackers to run remote commands, steal administrator credentials, and most dangerously, delete or modify security logs to obscure traces of the intrusion, making detection extremely difficult.
🛡️ Risks and Impacts
This attack represents a high-level threat as it directly targets the core of network infrastructure. When hackers can access and control routers, it means they can intercept all data traffic across the network, reroute data, and easily access other systems within the organization. This constitutes a sophisticated and long-running cyber espionage campaign aimed at surveillance and stealing critical data from target organizations.
💬 Does your organization regularly check the security of its routers and authentication servers? Let's share prevention strategies.