Chinese Fire Ant hackers weaponize Cisco IOS XR routers for covert spying

Fire Ant APT group has been observed using GRE tunnels on Cisco IOS XR routers to establish covert communication channels, a novel tactic not explained by router configuration. The technique enables persistent espionage on network infrastructure, indicating an evolution in their operational tradecraft. The full scope of affected networks remains unclear, but the targeting of core routing equipment raises concerns for critical infrastructure.