> TritonInfoSec News
Home / Sep 01, 2026 / Story
0
#3 The Hacker News general August 31, 2026 at 09:04 UTC

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

By [email protected] (The Hacker News)

AI Summary

China-nexus threat actor Fire Ant has expanded operations beyond VMware hypervisors to compromise Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts, establishing covert GRE tunnels undetectable in router configurations or commit histories. Incident responder Sygnia documented the campaign, which focuses on credential theft and log blinding — a significant escalation in network infrastructure targeting by a state-linked actor.

Read full article → https://thehackernews.com/2026/08/china-linked-fir…

Relevance score: 85.0/100

# More from September 01

  1. 1
    McKesson Confirms Data Breach as Attacker Deadline Looms SecurityWeek
  2. 2
    Berlin confirms data theft after Rhysida ransomware attack claims BleepingComputer
  3. 4
    More Details Emerge on Exploited PaperCut Vulnerabilities SecurityWeek
  4. 5
    Microsoft warns of TerminalFix attacks deploying reverse tunnels BleepingComputer
  5. 6
    ServiceNow Patches 3 Critical Code Injection Vulnerabilities SecurityWeek
  6. 7
    ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions The Hacker News
  7. 8
    Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets The Hacker News
  8. 9
    Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs SecurityWeek
  9. 10
    DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims The Hacker News