A China-linked cyberespionage group compromised Cisco routers and hid its activity from the network administrators who managed them, cybersecurity firm Sygnia said in an Aug. 27 report.
The group also recorded traffic moving through the devices and used them to probe other high-value networks, according to the report.
The hackers compromised systems that verify whether network administrators are authorized to log in to routers and other equipment, allowing them to capture administrator credentials, Sygnia said.
Sygnia tracks the group as Fire Ant and describes it as China-nexus. The firm has not publicly tied the hackers to a specific Chinese government agency.
Sygnia has not disclosed the affected organizations or countries, and no U.S. victim has been publicly identified….