Investigators identified an active Generic Routing Encapsulation tunnel on the router. This interface had no corresponding entry in the running configuration or commit history. The anomaly triggered a deeper investigation into the system’s integrity. Researchers discovered custom malware installed by the attackers to maintain persistent access.
This malicious software masqueraded as a legitimate system service. It was programmed to run only during alternating hourly intervals. This scheduling ensured persistence while minimizing resource usage on infected devices. To evade detection, the malware selectively suppressed specific system messages related to the tunnel. Legitimate administrators rarely noticed these suspicious activities in standard logs.
Simultaneously, the malware established outbound connections via Telnet. These links connected directly to infrastructure controlled by Fire Ant. This setup allowed for interactive shell access without generating typical event logs. The lack of logging made the intrusion significantly harder to trace.
Beyond basic router control, attackers exploited administrative privileges extensively. They intercepted traffic flowing through multiple connected devices. The captured data was saved into PCAP files for later analysis. These files were then uploaded to external FTP servers for retrieval.
The captures contained highly sensitive information. This included internal network topology and administrative links. Authentication flows and routing relationships were also recorded. Data transmitted with connected networks was fully visible to the intruders. Sygnia noted that this transformation turned the router into a data collection platform.
The device shifted from a simple pass-through component to a strategic observation point. Attackers could now monitor traffic moving through trusted paths. This capability provided deep visibility into the victim’s operational environment. The compromise effectively blinded the organization to its own data flows.
A hidden GRE tunnel linked the compromised router to a legacy Linux server. Hackers used this server as a staging and reconnaissance system. From this base, they probed high-value connected environments. These targets included critical infrastructure components.
Attackers scanned for common services like SSH, web, SMB/RPC, and RDP. Sygnia explained that the goal was to compromise the initial victim’s trusted infrastructure. This served as a hidden bridge to explore high-value connected networks. Analysts termed this technique „target behind the target.”
Researchers also uncovered a previously undocumented backdoor named BridgeAgent. It was disguised as a legitimate Zabbix monitoring agent. This backdoor functioned as a root-privileged systemd service. It ensured long-term persistence on the compromised host.
BridgeAgent allowed the creation of reverse shells over TLS. It also enabled the execution of additional payloads on the host. The GRE tunnel functionality was essential for BridgeAgent operations. It served as the primary hidden communication channel for the malware.
Fire Ant’s activities show significant similarities to the UNC3886 espionage group. Google previously documented UNC3886’s tactics and objectives. However, researchers noted clear differences in file naming conventions. Access paths and implementation details also varied between the two groups.
These variations suggest an independent evolution of their attack techniques. Despite these differences, origins and goals remain aligned with state-sponsored espionage. Sygnia emphasized the high level of sophistication observed in this campaign. The operation demonstrated strong operational discipline throughout the intrusion.
This indicates an actor with considerable resources and experience. The group specializes in attacking critical infrastructure systems. Their methods reflect a mature understanding of network defense mechanisms. Organizations must now review their router configurations more rigorously. Regular audits can help identify such hidden persistence mechanisms early.