Hackers Compromise Cisco Routers to Spy on Networks and Reach Critical Infrastructure

Fire Ant has moved beyond attacking individual systems and is now compromising network infrastructure that organizations trust to move traffic and manage access. The actor has turned Cisco IOS XR routers into platforms for surveillance, remote connectivity, and movement toward high-value environments. The campaign shows how an intruder can use a router as more than a gateway. Fire Ant created a GRE tunnel absent from running configuration and commit records, captured network traffic, and sent PCAP files to external FTP services. Sygnia said in a report shared with Cyber Security News (CSN) that it also interfered with logs and command output, leaving administrators with an incomplete view of activity. Analysts...

Læs hele artiklen hos kilden.