Incident responders at Sygnia say the China-linked espionage group Fire Ant has widened a long-running campaign that once focused on VMware hypervisors to now target Cisco IOS XR routers, TACACS authentication servers, and the Linux hosts used to manage them. By compromising these network control points, the attackers can intercept login credentials and tamper with security logging across high-value networks. The campaign shows nation-state actors increasingly pivoting from virtualization infrastructure to core networking gear to maintain stealthy, long-term access.
// source: thehackernews.com ↗