kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · not yet in the cluster map

fire-ant

2 stories · 2 in the wild · September 1, 2026 – September 2, 2026

evidence: 2 observed

sectors

  • technology 2 · Sep 2
  • telecom 1 · Sep 2

geography

  • china 2 · Sep 2

techniques

  • defense evasion 2 · Sep 2
  • lateral movement 1 · Sep 2
  • credential access 1 · Sep 1

attack phases seen

  • Defense evasion 2 · Sep 2
  • Persistence 2 · Sep 2
  • Credential access 1 · Sep 1

what we reported, newest first, grouped by story

Sep 1 – September 2, 2026 · 2 reports

  • Fire Ant (China-nexus) has expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers, and Linux management hosts — compromising the authentication and routing layer rather than the endpoints on top of it, and blinding security logging in the process (The Record, The Hacker News). Sygnia's framing: "it compromised the trust layer those systems depend on" (earlier coverage). · Sep 2 · observed · Threat Activity
  • Fire Ant has expanded from VMware hypervisors into routing and authentication infrastructure, compromising Cisco IOS XR routers, TACACS servers and Linux management hosts for credential theft and security-log blinding. Sygnia found the activity after spotting a live GRE tunnel interface that appeared in neither the running config nor the commit history (Sygnia, BleepingComputer). · Sep 1 · observed · Threat Activity