Your routers aren't just passing packets. According to Sygnia’s analysis of the Fire Ant campaign, they're serving as surveillance platforms for sophisticated state-backed actors. These actors exploit network infrastructure, which often sits outside your endpoint detection and response (EDR) coverage and rarely triggers alerts. When Fire Ant compromised Cisco IOS XR routers, they gained access and visibility across environments, harvesting credentials from TACACS servers and monitoring administrative activity in real time.
The shift matters because you've spent years hardening endpoints while leaving the trust layer exposed. Here's how to close that gap.
What You Need Before Starting
Infrastructure inventory:
- List all routers, TACACS servers, and authentication appliances
- Firmware versions for each device
- Current admin access lists with last login timestamps
- Network diagrams showing trust relationships between management infrastructure
Access and credentials:
- Console access to all network devices (not just SSH)
- Centralized syslog server with sufficient retention (minimum 90 days)
- TACACS or RADIUS server admin credentials
- Out-of-band management network if available
Tools:
- Network configuration management system (SolarWinds NCM, Rancid, or equivalent)
- SIEM with network device log parsing capability
- Baseline configuration templates for your router models
- File integrity monitoring tool that supports network OS filesystems
Team alignment:
- Network operations must grant security team read access to router configs
- Incident response runbook updated to include network infrastructure compromise scenarios
- Defined escalation path when router anomalies are detected
Step-by-Step Implementation
Phase 1: Establish Configuration Baselines
Week 1, Capture known-good state:
Pull current configurations from all routers and TACACS servers. Store these in version control for diff capability.
For Cisco IOS XR:
show running-config
show version
show file systems
Document every admin account, enabled service, and logging destination. Fire Ant actors deleted logs and modified firewall rules, you can't detect tampering without a baseline.
Week 2, Harden authentication infrastructure:
TACACS servers became credential harvesting points in the Fire Ant campaign. Treat them as Tier 1 critical assets:
- Enable command accounting on TACACS to log every privileged command
- Configure TACACS servers to send logs to your SIEM in real time
- Implement multi-factor authentication for all network device admin access
- Restrict TACACS server access to jump hosts only, no direct SSH from admin workstations
Phase 2: Implement Continuous Monitoring
Week 3, Deploy file integrity monitoring:
Fire Ant deployed custom malware to routers and modified system files. Standard antivirus doesn't run on network OS. You need file integrity monitoring (FIM).
Configure monitoring for:
- IOS XR filesystem changes (
/disk0:/,/harddisk:/) - Startup and running config mismatches
- Unexpected binary files in router storage
- Changes to AAA configuration blocks
Set alerts for any file creation in non-standard directories. Legitimate firmware updates follow change control; everything else is suspect.
Week 4, Build detection rules:
In your SIEM, create alerts for:
- Configuration changes outside maintenance windows
- Failed authentication attempts from non-standard source IPs
- New user account creation on network devices
- TACACS authentication from unexpected device IPs
- Traffic patterns showing data exfiltration (large outbound transfers from router IPs)
Sygnia observed Fire Ant capturing traffic from multiple routers simultaneously. A single compromised device uploading data might be diagnostics; three routers uploading to the same external IP is reconnaissance.
Phase 3: Validate Trust Relationships
Week 5, Audit cross-environment access:
Fire Ant exploited infrastructure relationships to breach third-party environments. Map every trust relationship:
- Which routers can reach which management networks?
- What TACACS servers authenticate for multiple security zones?
- Are your vendor-managed routers logging to your SIEM?
- Can your hypervisor management network reach router admin interfaces?
Andrew Obadiaru from Cobalt noted this campaign argues for continuous validation rather than periodic checks. Automate this: script a weekly job that queries router neighbor relationships and flags new adjacencies.
Week 6, Segment administrative access:
Create network-layer isolation between:
- Production routers and management workstations
- TACACS servers and general corporate network
- Out-of-band management and production networks
Fire Ant's effectiveness came from controlling the infrastructure that creates trust and reachability. Break that single point of control.
Validation: How to Verify It Works
Test your detection capability:
Schedule a controlled change: create a test user account on a non-production router during off-hours. Your SIEM should alert within 5 minutes. If it doesn't, your log forwarding or parsing is broken.
Verify configuration drift detection:
Manually add a single ACL line to a router config. Your configuration management system should flag the unauthorized change within your defined polling interval (typically 15-60 minutes).
Audit your baselines:
Pull current configs and diff against your Week 1 baselines. Every delta should map to an approved change ticket. Unexplained differences indicate either poor change control or compromise.
Test TACACS logging:
SSH to a router using TACACS authentication and run privileged commands. Verify those commands appear in your SIEM with username, timestamp, and command text. Fire Ant harvested credentials as they were used, you need that same visibility.
Maintenance and Ongoing Tasks
Daily:
- Review SIEM alerts for network device anomalies
- Check for configuration drift in automated reports
Weekly:
- Validate that all network devices are sending logs
- Review new trust relationships flagged by automated scans
- Audit admin account last-login timestamps (dormant accounts may indicate credential theft)
Monthly:
- Review and update router ACLs to remove stale rules
- Audit TACACS command accounting logs for unusual privileged access patterns
- Test incident response procedures for network infrastructure compromise
Quarterly:
- Re-baseline all router configurations
- Review and update network device inventory
- Conduct tabletop exercise simulating router compromise scenario
After any vendor relationship change:
- Re-audit trust relationships if a managed service provider gains or loses access
- Verify that terminated vendor accounts are revoked from TACACS
- Review router configs for vendor-specific management interfaces
The Fire Ant campaign ran from 2022 through at least 2026, evolving beyond hypervisors to target the infrastructure layer most organizations treat as legacy technology. Your routers provide reach, visibility, and control, either for your operations team or for an adversary who's learned you're not watching. Treat network infrastructure as first-class security assets requiring the same monitoring, hardening, and incident response readiness you apply to endpoints.
