Sygnia found that Fire Ant shifted from VMware hypervisors to Cisco routers, TACACS servers, and Linux management hosts, using a hidden GRE tunnel and custom malware to maintain persistence and spy on traffic. The group also deployed a disguised backdoor called BridgeAgent, abused trusted infrastructure to reach high-value networks, and overlaps with the Chinese espionage group UNC3886. #FireAnt #BridgeAgent #UNC3886 #CiscoIOSXR

Give it the mission, not the prompts. BridgeAgent designs, ships, and fixes software in a recursive loop, rewriting itself to get sharper each pass, with the goal of taking you out of the loop for goo...