与中国关联的黑客组织“火蚁”攻破思科核心路由器，屏蔽安全监测遥测
China-linked 'Fire Ant' hackers compromise core Cisco routers to blind security telemetry
- 具有中国官方背景的威胁实体“火蚁”（Fire Ant）侵入了分布在12个国家的思科边缘路由器，构建起不受监控的代理中继网络。 State-sponsored actor 'Fire Ant' compromised edge Cisco routers across 12 countries to create an unmonitored proxy relay mesh.
- 该组织使用完全驻留于路由器易失性内存中的特制Rootkit，以规避文件系统完整性检查。 Utilized bespoke rootkits residing strictly in volatile router memory to evade filesystem integrity scans.
- 借此对北美及东南亚的国防承包商与电信运营商展开了持久的网络间谍活动。 Facilitated persistent espionage against defense contractors and telecommunications providers in North America and Southeast Asia.
据网络安全应急响应机构 Sygnia 通过《BleepingComputer》披露，一个被追踪为“火蚁”（Fire Ant）的中国国家支持黑客组织，劫持了关键公用事业骨干网络中的核心思科 IOS XR 边缘路由器及中央身份验证服务器。攻击者建立了隐蔽的 GRE 路由隧道以窃取管理员凭据，并直接修改网络硬件上的命令行二进制程序，实施审计日志压制并彻底致盲安全防御团队。
这一行动复制了“伏特台风”（Volt Typhoon）和“盐台风”（Salt Typhoon）等组织惯用的边缘设备漏洞利用模式。由于边缘路由器极少支持第三方终端防护软件，“火蚁”通过篡改固件级日志彻底抹除了取证痕迹。攻破身份认证服务器与核心传输路由器，使中国情报机构能够在潜在的未来冲突前夕，完成关键基础设施渗透，在外国供水、电力与交通网络中长期预置具有隐蔽控制权限的跳板。
A Chinese state-sponsored group tracked as Fire Ant hijacked core Cisco IOS XR edge routers and central authentication servers across critical utility backbones, incident response firm Sygnia reported via BleepingComputer. Operators established stealth GRE routing tunnels to harvest administrative credentials, then modified command binaries directly on network hardware to suppress audit logs and blind security teams.
The campaign mirrors edge exploitation blueprints used by units like Volt Typhoon and Salt Typhoon. Because edge routers rarely support third-party endpoint protection software, Fire Ant manipulated firmware-level logging to eliminate forensic detection. Compromising identity servers and core transit routers grants Chinese intelligence persistent, pre-positioned access inside foreign water, power, and transport networks ahead of potential future conflicts.
国内技术论坛上的中国网络安全研究人员普遍回避提及该组织的官方背景，而是聚焦于从纯技术角度客观分析该Rootkit仅驻留内存的持久化潜伏机制。
Chinese cybersecurity researchers on domestic forums avoided naming state affiliations, instead clinically analyzing the rootkit's memory-only persistence mechanics.
将“火蚁”定性为APT高级持续性威胁组织的海外报道在微信和微博上被列入黑名单；国内科技资讯网站亦被明令禁止转载西方发布的安全警报。
Foreign reports naming 'Fire Ant' as an APT cluster were blacklisted on WeChat and Weibo; domestic tech portals were forbidden from reprinting Western security advisories.
针对边界网络设备（路由器、VPN网关）的攻击已成为解放军与国安部绕过企业内网多因素身份验证的标准作业程序。
Targeting perimeter network devices (routers, VPN gateways) has become standard PLA/MSS operating procedure to bypass multi-factor authentication inside enterprise boundaries.