Sygnia highlights Fire Ant risks from compromised routers, authentication systems in critical infrastructure https:// industrialcyber.co/threats-att acks/sygnia-highlights-fire-ant-risks-from-compromi
mastodon:infosec-exchange 27d ago
Between September 8-10, 2026, Wikipedia editors created new articles on Sygnia, PathCare, Ectethmoid, Canasnack, Won Myong-gyong, and Astron Energy Refinery, covering businesses, biological taxa, and individuals ranging from 4,382 to 10,433 words.
Fire Ant Evolves: From Hypervisors to Trusted Infrastructure Fire Ant, first reported in 2025, remained active in 2026 and expanded its operations beyond hypervisors into the trusted infrastructure that routes traffic, authenticates administrators, manages access, and records activity. The main finding is that the actor was no longer targeting only individual systems, it was targeting the infrastructure layer that controls how entire environments connect and operate both within and across organi
By September 2, 2026, researchers at Sygnia reported that the China-nexus actor Fire Ant expanded its long-running espionage campaign from VMware environments to target Cisco IOS XR routers and TACACS authentication servers, rewriting logs to remain undetected.