Loading story…
Sygnia disclosed new activity by Fire Ant, a China-nexus threat actor conducting long-running espionage through trusted enterprise infrastructure. The group targets routers, authentication systems, and Linux management hosts—systems that can provide privileged access and visibility across victim environments.
Fire Ant uses these footholds to collect intelligence and investigate routes into connected, high-value environments. Organizations should prioritize monitoring and hardening of network devices, identity infrastructure, and Linux administration systems, particularly for anomalous privileged access and lateral-movement activity originating from trusted management assets.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Sygnia identified BridgeAgent, a previously undocumented root-level backdoor disguised as a Zabbix monitoring agent, alongside malware used to hide GRE tunnels, suppress logs, and enable remote access on compromised infrastructure. The researchers also assessed that Fire Ant strongly overlaps with the China-linked UNC3886 group and published indicators, hunting guidance, and YARA rules.
Sygnia disclosed long-running espionage activity attributed to the China-nexus threat actor Fire Ant. The actor abused routers, authentication systems, and Linux management hosts to collect intelligence and explore routes into connected high-value environments.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcemalware.news
Open sourcesygnia.co
Open sourcesygnia.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint advisory from the UK **NCSC**, the United States, and other international partners warned that China-nexus threat actors are increasingly using large covert networks of compromised **SOHO routers, IoT devices, firewalls, and NAS systems** to route malicious traffic, hide attribution, and support espionage and disruptive operations. The warning said these botnet-style proxy networks are used across the full cyber kill chain, from reconnaissance and malware delivery to command-and-control and data theft, and identified activity tied to **Volt Typhoon**, **Flax Typhoon**, and the **Raptor Train** botnet. Officials said Volt Typhoon’s **KV Botnet** relied heavily on end-of-life Cisco and Netgear routers, while Raptor Train infected more than **200,000** devices worldwide and was reportedly controlled by **Integrity Technology Group**. Governments said the scale and churn of these compromised-device networks make traditional static IP blocklists increasingly ineffective, creating what some reporting described as rapid indicator loss or “IOC extinction.” Agencies urged organizations to map internet-facing and edge assets, baseline normal traffic from routers and IoT devices, enforce **MFA**, apply dynamic threat intelligence, use allow-listing and **zero trust** controls, and actively hunt for suspicious proxy-node behavior on residential, branch, and enterprise-connected infrastructure. The disclosures also linked the threat to broader Chinese pre-positioning activity against critical infrastructure and telecom environments, underscoring how weakly secured edge devices continue to provide durable operational cover for state-backed intrusions.
Jun 29, 2026
SentinelLABS disrupted multiple China-nexus cyberespionage campaigns between June 2024 and March 2025 targeting SentinelOne, a South Asian government entity, a European media organization, and more than 70 other victims. The ShadowPad and PurpleHaze clusters used chained zero-days in edge appliances, including `CVE-2024-8963` and `CVE-2024-8190`, alongside ShadowPad malware protected by ScatterBrain/ScatterBee obfuscation, the Go-based GOREshell reverse-SSH backdoor, Nimbo-C2, operational relay box networks, and log removal. SentinelOne reported that it was not compromised. A joint Tenable-SentinelOne review shows that this activity reflects a broader cross-actor pattern: 93 CVE-to-actor attribution pairs across 82 vulnerabilities converged on all seven identified edge-device vendors, despite only 21% overlap in the CVEs tracked independently. Twelve flaws have confirmed exploitation by multiple China-, Russia-, DPRK-, or Iran-linked groups and ransomware operators. F5, Citrix, and Ivanti EPMM and Connect Secure deployments face recurring exposure and exploitation; organizations should prioritize edge-device patching, disable unnecessary features, continuously monitor remote-access systems, and use segmentation and other defense-in-depth controls to limit lateral movement after a breach.
Aug 26, 2026
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026