China linked group compromises Cisco routers and servers to steal credentials

The record

Written from the 1 report below. Nothing here is unsourced.

A China-linked espionage group tracked as Fire Ant has expanded its attacks beyond VMware hypervisors to compromise Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts, according to incident response firm Sygnia.
The group used the compromised routers to capture network traffic, harvest credentials with previously undocumented tools like TacTap and BridgeAgent, and suppress logging and telemetry to hide its activity.
Sygnia assessed the group, which overlaps with the previously reported UNC3886, explored paths to connected high-value environments including critical infrastructure, though this was limited to scanning and connection attempts.
The case matters because controlling routers gives attackers visibility into trusted network traffic, and the group's evidence-suppression tactics make such intrusions hard to reconstruct.

Whether further victims or confirmed compromise of critical infrastructure networks are disclosed beyond the scanning activity noted.
Possible patches, detections, or advisories from Cisco, Mandiant, or other vendors responding to the newly described router and TACACS tradecraft.
How defenders and investigators respond to Sygnia's recommendation to treat routers, TACACS servers, and jump hosts as first-class forensic assets.

1 report

English national1

All filed from India

Named China · Cisco · Cybereason · SentinelOne · Vmware · Zabbix · Fire Ant · Mandiant · Sygnia · UNC3886

The 1 report is listed beside the record.

Answers cite the reports above, or say they can't.