Fire Ant Espionage Group Injects Malware Into TACACS+ Authentication Daemons, Sygnia Finds

A Chinese-linked espionage group has developed a way to attack network infrastructure at a level that leaves almost no forensic trace, and the technique is so novel that it has been described as the first publicly documented example of its kind. TechTimes reported on Sep 1 that security firm Sygnia documented an attack tool it calls TacTap, which belongs to a group it tracks as Fire Ant, a China-nexus espionage operation. The malware does something that has not been seen before in public reporting: it injects a malicious shared library into a running TACACS+ authentication daemon, the process that governs who is allowed to touch network equipment, and in doing so it corrupts the audit trail that security teams rely on while evading the file-integrity monitoring that is supposed to catch exactly this kind of intrusion.

Network authentication is the last line of defense in most enterprises. TACACS+ is the protocol that network administrators use to log into routers, switches and firewalls, and it is treated as trusted infrastructure precisely because compromising it means owning the keys to the network. Fire Ant's tool is significant not just because it targets that trust boundary, but because of how it operates: instead of writing a persistent file that a scanner could detect, it lives in memory inside a process that is already trusted, and it deletes its own footprint from disk after loading.

Key Facts

TechTimes reported on Sep 1, citing Sygnia's report published Aug 27, that TacTap injects a malicious shared library named libseconfd.so into the running tac_plus process, the TACACS+ authentication daemon. The library is deleted from disk after it is loaded, which means the malware leaves no static file for antivirus or file-integrity monitoring tools to flag, and it communicates with a command and control channel through a UNIX socket placed at /var/run/acpid.lock. The report describes how credentials harvested from the authentication process are written to a log file at /var/log/.tacplus.acct, XOR-encoded with the single byte key 0xEF.

The 0xEF XOR key is itself a fingerprint. Sygnia noted that Mandiant previously documented a different China-linked group, UNC3886, using the same XOR key in an implant called LOOKOVER, and the overlap is one of the pieces of evidence tying TacTap to Chinese state-sponsored activity. The Fire Ant group has also been linked to the use of a Linux backdoor called BridgeAgent, which shares infrastructure with the TACACS+ attack, and the same campaign family has deployed a suite of implants on Cisco IOS XR routers that can suppress syslog messages and filter the results of CLI commands, making the router itself lie to the operators who query it.

The operational details show how deep the access runs. Sygnia reported on Aug 27 that BridgeAgent persists as a systemd unit running as root and polls attacker infrastructure over TLS on port 443 for commands, while the campaign redirects SSH traffic from port 22 to port 443 on compromised hosts and planted components that were first deployed in 2025 were still being reused for hands-on activity in 2026. The investigation began when analysts detected a Generic Routing Encapsulation tunnel interface running on a Cisco IOS XR router with no configuration history explaining its creation, according to Sygnia's Aug 27 report, and the same reporting notes that at least one backdoor kept running in memory after its file was deleted from disk.

The attack fits a pattern that security researchers have been documenting through 2026. Sygnia's report, published Aug 27 and covered by TechTimes on Sep 1, describes the TACACS+ injection as an evolution in stealth techniques, moving from file-based implants to memory-only execution that blends into processes that are already trusted by the operating system. The choice of TACACS+ is strategic: it is the protocol that controls access to network gear, so a daemon compromised at that layer gives an attacker visibility into who is logging in, the ability to harvest credentials, and the capacity to modify what those users see when they authenticate. That makes the compromise nearly invisible to the operators who are supposed to detect it, because the very system they use to verify their network is the system that is lying to them.

The same campaign has attacked the routers themselves, and The Hacker News reported in August 2026 that Fire Ant hijacked Cisco IOS XR routers to steal credentials and blind security logs. Sygnia described a router implant that inspects outgoing log messages and forwards them only if they contain the string Health, silently dropping all other syslog traffic so the router still appears to report to the security information and event management system, and a component that alters the command-execution path to append an exclude filter to show commands, hiding the attacker's tunnel configuration from administrators. The campaign also deploys a Linux backdoor called BridgeAgent, which masquerades as a Zabbix monitoring agent, and SecurityOnline reported that the group maintains access using Medusa and REPTILE rootkits, custom SSH backdoors and binaries renamed to impersonate endpoint security agents.

Analysis

What this really means is that the security industry is facing a class of attack that defeats the monitoring model most enterprises rely on. File-integrity monitoring, endpoint detection and response agents and antivirus all assume that a compromise leaves a file, a process or a registry key that can be flagged. TacTap is built to violate that assumption: by injecting into a process that is already on the trusted list and deleting its library from disk, it operates in a space that the monitoring tools are not designed to see. The attack does not need to evade detection at the endpoint because it lives inside a process that the endpoint considers legitimate.

The bigger picture here is that network infrastructure, not just endpoints, has become the target of choice for sophisticated espionage groups. Fire Ant is not trying to steal data from a server, it is trying to control the fabric that connects servers: the routers, the switches and the authentication systems that govern who is allowed in. An attacker with control of the TACACS+ daemon can harvest the credentials of every network administrator who logs in, can present a false view of the network's state to those administrators, and can move laterally through the network with the credentials of the people whose job is to secure it. The Cisco IOS XR implant suite described in the same report, which can suppress syslog and filter CLI output, extends the same idea to the routers themselves, making the network infrastructure a participant in its own deception.

The link to Mandiant's UNC3886 through the shared 0xEF XOR key is worth treating with appropriate caution. XOR with a single byte key is a weak encryption scheme, so the shared key could be coincidental or could reflect shared tooling, shared developer culture or shared doctrine between groups. Sygnia's attribution to Fire Ant and its characterization of the group as China-nexus is based on a body of evidence, but attribution in this space is never definitive, and the public evidence does not name a specific sponsor. What is not in dispute is the technique itself, which is novel, and the target, which is the most sensitive layer of enterprise networking.

Why It Matters

For security teams, the report is a reminder that the authentication layer of the network needs the same scrutiny as endpoints, and that the TACACS+ daemon, a component many organizations treat as a trusted black box, is now a documented target. For defenders, the memory-only, fileless nature of the attack means that the traditional response, scan the disk and block the file, will not work, and that detection has to move to behavioral monitoring of processes and of the audit logs themselves. For equipment vendors, particularly those shipping TACACS+ implementations, the report raises the question of whether the daemon can be hardened against library injection, and whether the audit trail it writes can be made tamper-evident. And for the wider industry, the technique represents a new entry in the playbook of state-sponsored network intrusion, one that other groups will study and adapt, which means the window to defend against it is the window before it becomes common.

Next Up

In the coming weeks, watch for follow-up reporting and vendor advisories on TACACS+ hardening, and for any guidance from Cisco or other networking vendors on detecting library injection into authentication daemons. The longer-term questions are whether memory-only attacks on network infrastructure become a standard technique in espionage tooling, and whether the security industry can move detection from file-based signatures to process behavior and audit-log integrity fast enough. For defenders, the near-term takeaway is that the authentication daemons on the network perimeter are now a documented target, that the malware that hit them can be invisible to the disk scanner, and that the first line of defense is not a new signature but a change in what security teams watch.