Sygnia's incident response report on Fire Ant reveals a significant tactical shift. The China-linked espionage group has moved beyond VMware ESXi to compromise Cisco IOS XR routers, TACACS+ servers, and Linux management hosts — embedding persistence in the routing and authentication layers of enterprise networks.
#FireAnt #CiscoSecurity #ThreatIntelligence #IncidentResponse
https://cyberworldops.eu/en/fire-ant-extends-operations-cisco-ios-xr-routers-tacacs-and-linux