A Chinese espionage group is converting Cisco routers into surveillance infrastructure. Fire Ant — previously known for targeting VMware ESXi hypervisors — has expanded to Cisco IOS XR routers and TACACS+ authentication servers, stealing credentials and installing covert tunnels while disabling the logs that would reveal the compromise. When the attacker owns the network infrastructure itself, every access control and segmentation conversation changes fundamentally.

Meanwhile, two critical vulnerabilities — a CVSS 9.8 unauthenticated RCE in Langflow and a CVSS 10.0 authentication bypass in JFrog Artifactory — are both being exploited in the wild within days of disclosure. The exploitation speed continues to outpace enterprise patching cycles.

In the News

Fire Ant Pivots from VMware to Cisco IOS XR Routers and TACACS+ Servers

China-nexus espionage group Fire Ant has expanded its infrastructure targeting from VMware ESXi to Cisco IOS XR routers and TACACS+ authentication servers, according to incident response findings published by Sygnia. The group’s operational playbook targets the trust foundation of enterprise networks: the devices that route traffic and the servers that authenticate administrators to those devices.

The attack chain follows a consistent pattern. Fire Ant compromises TACACS+ servers to harvest network administrator credentials, then uses those credentials to access IOS XR routers directly. Once on the router, the group installs unauthorized GRE tunnels — creating an encrypted exfiltration path that blends with legitimate traffic — and disables syslog forwarding to blind security operations. The combination of credential theft, covert tunneling, and log suppression means defenders lose visibility at the exact moment they need it most.

This represents a significant escalation in infrastructure-layer targeting. Previous Fire Ant campaigns focused on hypervisor-level access, which already gave the group visibility into guest VMs. Moving to routers and authentication servers puts the group below the application layer entirely — in a position to intercept, redirect, or exfiltrate traffic without touching endpoints where EDR might detect the activity. The MITRE ATT&CK mapping spans T1557 (Adversary-in-the-Middle), T1556 (Modify Authentication Process), T1562.006 (Indicator Blocking), and T1572 (Protocol Tunneling).

What defenders should do: Audit IOS XR configurations for unauthorized GRE tunnels and unexpected access-list modifications. Verify TACACS+ server integrity — rotate shared keys, enforce encrypted transport (TACACS+ over TLS), and audit administrative session logs. Implement out-of-band configuration integrity monitoring that does not rely on the device’s own syslog.

CVE-2026-0768: Langflow Unauthenticated Python RCE Exploited in the Wild

CVE-2026-0768 is a CVSS 9.8 unauthenticated remote code execution vulnerability in Langflow, an open-source AI workflow builder widely used for LLM application development and prototyping. The flaw allows attackers to execute arbitrary Python code on the host without any credentials. VulnCheck confirmed active exploitation within days of public disclosure.

Langflow is frequently deployed in development and staging environments with minimal access controls — often internet-facing for collaboration purposes. The unauthenticated nature of CVE-2026-0768 makes every exposed instance an immediate target. This is not a theoretical risk requiring phishing or credential access; it is point-and-shoot RCE against AI development infrastructure.

What defenders should do: Patch Langflow immediately or take instances offline. Inventory all Langflow deployments, including shadow IT instances spun up by data science teams. Segment AI development environments away from production networks and enforce authentication at the network layer even if the application does not require it.

CVE-2026-82329: JFrog Artifactory Authentication Bypass — Supply Chain at Risk

CVE-2026-82329 is a CVSS 10.0 authentication bypass in JFrog Artifactory, the artifact repository that sits at the center of enterprise CI/CD pipelines. Exploitation was confirmed in the wild within days of public disclosure. An attacker who bypasses authentication on Artifactory gains the ability to inject malicious artifacts — libraries, containers, binaries — into the software supply chain before they reach production.

The speed of exploitation underscores a recurring pattern: critical vulnerabilities in developer infrastructure are being weaponized faster than security teams can evaluate and deploy patches. Artifactory is a trusted component in build pipelines — artifacts pulled from it are typically not re-validated by downstream build steps, making it an ideal injection point.

What defenders should do: Patch immediately. Audit Artifactory access logs for unauthorized admin sessions, new user creation, and bulk artifact uploads since the disclosure date. Verify artifact integrity using checksums from known-good sources. Consider implementing software bill of materials (SBOM) validation in CI/CD pipelines as a compensating control.

TerminalFix ClickFix Campaign Upgrades to Reverse Tunnel Deployment

Microsoft warns that the TerminalFix campaign — an evolution of the ClickFix social engineering technique — now deploys reverse tunnels into enterprise networks. The attack uses fake Cloudflare CAPTCHA pages that instruct users to open Windows Terminal and paste a PowerShell command. The command downloads and executes a payload that establishes a reverse tunnel, giving attackers persistent inbound access that bypasses perimeter firewalls entirely.

This is a user-initiated execution attack. Traditional email and web gateways do not block it because the user voluntarily runs the command. The fake CAPTCHA is convincing because users are conditioned to complete CAPTCHA challenges without scrutiny. Once the reverse tunnel is established, the attacker has a direct network path into the enterprise from a legitimate user workstation.

What defenders should do: Deploy PowerShell constrained language mode or application control policies that restrict arbitrary script execution. Monitor for outbound tunnel establishment from user workstations — particularly to cloud infrastructure IP ranges. DNS-layer security blocks C2 domain resolution before the tunnel is established, which is the earliest interception point.

Defender Action Items

  • Audit Cisco IOS XR router configurations for unauthorized GRE tunnels, unexpected route-maps, and syslog forwarding changes. Rotate TACACS+ shared keys and enforce TLS transport.
  • Patch Langflow (CVE-2026-0768) immediately or take all instances offline. Inventory shadow IT deployments in data science and AI development teams.
  • Patch JFrog Artifactory (CVE-2026-82329) immediately. Audit access logs for unauthorized sessions since the disclosure date. Validate artifact integrity in CI/CD pipelines.
  • Patch Ruby on Rails (CVE-2026-66066) and audit for arbitrary file reads and C2 activity in application logs.
  • Deploy PowerShell constrained language mode and monitor for outbound reverse tunnel establishment from user endpoints to combat TerminalFix ClickFix lures.

Detection Queries

Detect unauthorized GRE tunnels on Cisco IOS XR by monitoring for configuration changes that include tunnel interface creation. This Splunk SPL query surfaces configuration change events from IOS XR devices that reference GRE tunnel parameters:

index=network sourcetype="cisco:ios:xr" ("interface Tunnel*" OR "tunnel mode gre" OR "tunnel source" OR "tunnel destination")
| stats count by host, _time, _raw
| where count > 0
| sort -_time

Detect TerminalFix-style PowerShell reverse tunnel establishment. This KQL query identifies PowerShell spawned from Windows Terminal executing encoded or web-download commands followed by outbound connections:

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("WindowsTerminal.exe", "wt.exe")
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("Invoke-WebRequest", "iwr", "curl", "DownloadString", "-enc", "-EncodedCommand")
| join kind=inner (
    DeviceNetworkEvents
    | where RemotePort in (443, 8443, 2222, 4443)
    | where ActionType == "ConnectionSuccess"
) on DeviceId
| project Timestamp, DeviceName, ProcessCommandLine, RemoteIP, RemotePort

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) — Daily cybersecurity news, SE angles, and detection queries.