Fire Ant hackers repurpose Cisco routers for espionage

Security teams at a European cloud provider discovered an unexplained GRE tunnel interface on a Cisco IOS XR router during a routine audit. The tunnel lacked any corresponding configuration or commit history, suggesting unauthorized activation. Analysis confirmed the presence of Fire Ant, a Chinese advanced persistent threat group previously linked to cyber-espionage operations targeting network infrastructure.

What happened

The attackers exploited an undocumented feature in Cisco IOS XR to establish GRE tunnels, which were then used to route sensitive traffic off-network. GRE, a protocol designed for encapsulating network layer packets, was repurposed to create a covert channel that evaded standard monitoring tools. The compromised router showed no signs of traditional malware, relying instead on legitimate but unlogged configuration changes to maintain persistence.

Researchers noted that the technique does not exploit a software vulnerability but rather manipulates built-in functionality. This approach complicates detection, as the malicious activity appears as normal GRE traffic. The source did not specify the volume of data exfiltrated or the duration of the compromise.

What we don't know yet

The exact method used to gain initial access to the router remains unclear. While Fire Ant has historically exploited known vulnerabilities in network devices, the current incident did not reveal a specific entry point. Additionally, the scope of affected organizations is unknown, as the discovery was made during an internal audit rather than a coordinated industry response. No public indicators of compromise have been released at this time.