# Fire Ant cyberespionage campaign against Cisco routers > Live situation record from CLSTR: https://clstr.news/situations/fire-ant-cyberespionage-campaign-against-cisco-routers > Updated: 2026-09-03T15:26:17.000Z. Sources: 6. Developments: 2. A China-linked threat actor known as ‘Fire Ant’ has been identified conducting a sophisticated cyberespionage campaign targeting Cisco routers running the IOS XR operating system. Reports from cybersecurity firm Sygnia indicate that the group compromises Cisco devices, TACACS authentication servers, and Linux management hosts to establish long-term persistence. To evade detection, the actors utilize advanced techniques such as suppressing syslog and command-line interface outputs, and operating generic routing encapsulation (GRE) tunnels that do not appear in running configurations or commit histories. The group’s activities include capturing network traffic into PCAP files, stealing administrative credentials through library injection, and deploying backdoors like the Medusa rootkit and BridgeAgent. By hijacking these management paths, Fire Ant is able to map network topologies and explore connected target networks from within compromised organizational interconnections. ## Timeline ### 2026-09-03: Fire Ant cyberespionage group targets Cisco routers A China-linked cyberespionage group called ‘Fire Ant’ has compromised Cisco routers to monitor traffic, steal credentials, and hide its presence from network administrators. 2 sources. https://clstr.news/cluster/fire-ant-cyberespionage-group-targets-cisco-routers ### 2026-08-31: Fire Ant threat actor targets Cisco routers for espionage The China-nexus threat actor Fire Ant is targeting Cisco IOS XR routers and management infrastructure to conduct long-term espionage and steal credentials within high-value networks. 4 sources. https://clstr.news/cluster/fire-ant-threat-actor-targets-cisco-routers-for-espionage --- Cite as: Fire Ant cyberespionage campaign against Cisco routers. CLSTR, https://clstr.news/situations/fire-ant-cyberespionage-campaign-against-cisco-routers