Researchers discovered that the Chinese Fire Ant hacking group has deployed a new tactic using invisible GRE tunnel interfaces on Cisco IOS XR routers to conduct espionage. The tunnels remain undetectable in running configurations and commit histories, reported between 31 August and 1 September 2026.
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
The researchers discovered Fire Ant's new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history. [...]
The researchers discovered Fire Ant's new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history. https://www. bleepingcomputer.com/news/secu rity/chinese-fire-ant-hackers-turn-cisco-routers-into-spying-platforms/
🤖 Chinese Fire Ant APT turns Cisco routers into spying platforms: researchers found an unexplained active GRE tunnel interface on a Cisco IOS XR router, invisible to running config and commit history, used for covert comms. 🔗 https://www. bleepingcomputer.com/news/secu rity/chinese-fire-ant-hackers-turn-cisco-routers-into-spying-platforms/ # CyberSec # APT # Cisco # Malware