China-linked Fire Ant actor exploits Cisco routers for credential harvesting and traffic interception

The threat actor Fire Ant has compromised Cisco routers to intercept network traffic and harvest TACACS credentials while actively suppressing security telemetry. This campaign demonstrates a sophisticated pivot strategy to gain unauthorized access to high-value internal networks by leveraging infrastructure-level vulnerabilities.