2 SEP 2026 — Sygnia has documented a Chinese espionage group it calls Fire Ant running fake system services on Cisco IOS XR routers during alternating hours, hiding GRE tunnels by suppressing the syslog messages that would name them. The routers were never the objective. Compromising the TACACS server alongside them is what buys authentication to every device that trusts it.
What was found
Sygnia, an incident response firm, describes activity in critical infrastructure environments with strong overlaps with UNC3886, the group Google has previously documented, though with differences in implementation details.
The targets were Cisco IOS XR routers, TACACS authentication servers and Linux management hosts. Custom malware created fake system services that ran during alternating hours. The operators established hidden GRE tunnels, suppressed the syslog messages that would have revealed them, captured traffic to PCAP files, and deployed a previously undocumented backdoor called BridgeAgent, disguised as a Zabbix monitoring agent.
Sygnia calls this a target-behind-the-target approach, where compromised infrastructure becomes a covert bridge into the networks the attackers actually want.
The authentication server is the prize
Coverage of an intrusion like this leads with the routers because routers sound like the interesting part. TACACS is where the value is.
TACACS is the protocol network devices use to check administrator credentials centrally, so that a network team manages one account database rather than a login on every switch. Every device configured to use it will accept whatever that server says.
An operator holding the TACACS server can authenticate as an administrator to every device that trusts it, without exploiting anything further. The resulting sessions are indistinguishable from legitimate ones, because as far as the devices are concerned, they are.
Alternating hours is a specific countermeasure
Running fake services during alternating hours seems odd, but it is a technique aimed precisely at how anomaly detection works.
Behavioural baselining establishes what normal looks like for a host at a given time and alerts on deviation. A process that runs continuously establishes itself as normal and is then ignored. A process that runs at random times looks anomalous. One that alternates on a predictable rhythm is absorbed into the baseline as a scheduled task, which is exactly what the baseline is designed to accommodate.
Suppressing syslog for the tunnels works on the same principle from the other direction. The device is not silent, which would itself be an alert. It is selectively quiet about one thing, and everything else continues to report normally.
GRE is the boring choice, and that is the point
Generic Routing Encapsulation dates from the 1990s, offers no encryption of its own and is configured on network equipment daily for entirely legitimate reasons. An operator with a preference for stealth could have built something bespoke, and chose a protocol every network engineer recognises.
The reasoning is straightforward: bespoke tunnelling produces traffic that matches nothing, which is exactly what protocol-anomaly detection looks for. A GRE tunnel between two devices in an operator's own address space is a configuration a network team might genuinely have made, so the question a reviewer asks is who set it up rather than what it is.
Answering that question is harder than it sounds in a large network, because tunnel configurations accumulate over years and the person who added one in 2019 has usually left. The absence of a configuration management database with an owner recorded against each tunnel is what turns a visible artefact into an invisible one.
Network devices are the gap in every remediation plan
Routers and switches are a durable place for an attacker to persist, for three reasons that have nothing to do with vulnerabilities.
They rarely run endpoint detection, as the platforms do not support it. They log sparsely by default, since verbose logging on a carrier-class router costs performance. And they are almost never rebuilt; a server gets reimaged during incident response, but a core router is patched at most, because taking it offline means an outage.
So an operator on a router survives the remediation applied to everything else. The organisation reimages the servers, rotates the credentials, declares the incident closed, and the tunnel is still there.
Why this is a Singapore story
UNC3886 is not an abstract reference here. On 18 July 2025 Singapore's coordinating minister for national security named the group publicly as attacking the country's critical infrastructure, and the Cyber Security Agency and IMDA described a multi-agency response, Operation CYBER GUARDIAN, defending the telecommunications sector. It was Singapore's first public attribution of this kind.
The techniques Sygnia now describes are the ones a defender in a regional telecommunications, power or transport operator should be checking for, and the check is specific rather than general: whether GRE tunnels exist that nobody configured, whether syslog filtering rules were added that nobody requested, and whether the TACACS server has authentication events from source addresses that are not the network operations centre.
We reported that Singapore's Cyber Security Agency has been extending its critical-infrastructure framing to frontier AI systems. The older problem has not gone anywhere. It is the one with an operator already inside.
View author profile → · Editorial policy
