Fire Ant Left the Logging On. It Just Made Sure Only the Word 'Health' Got Through. This Is Pattern 52, and It Is the Best Version of It We Have Seen.
- Patrick Duggan
- 6 hours ago
- 6 min read
Sygnia published research this week on Fire Ant, a China-nexus espionage actor, expanding from VMware hypervisors into Cisco IOS XR routers, TACACS authentication servers and Linux management hosts. The whole report is worth your time and the credit for every technical detail below is theirs.
One component in it stopped us cold. On a compromised host, Fire Ant installed a modified system library that inspected every outgoing log message and forwarded it only if the message contained the string "Health."
Sit with that for a second, because it is not log deletion and it is not log tampering, and the difference is the entire point.
Why That Is Worse Than Turning Logging Off
If an attacker kills your syslog daemon, you find out. Not immediately, maybe not for hours, but a log source that stops emitting is a detectable condition, and most mature shops alert on exactly that. Silence is a signal.
If an attacker edits your logs, you may find out. Timestamps skip, sequence numbers gap, the file size does not match the retention math. Tampering leaves scars.
Fire Ant did neither. The log pipeline stayed up. The collector kept receiving. The dashboard kept drawing a line. What arrived was a curated subset consisting of the messages containing the word "Health" — which is to say, precisely the messages a monitoring system uses to conclude that everything is fine.
The device reported its own wellbeing and nothing else. Not because it was lying, but because the only sentences it was permitted to finish were the reassuring ones.
That is not evasion of a detection. That is the weaponization of a detection. The health check became the exfiltration channel for the idea that there was nothing to see.
We Have a Name for This and It Has Been on Our Wall Since June
We track this shape internally as Pattern 52, the subtraction attack: an operation that wins by removing an artifact a defense assumes will exist, rather than by adding one it must avoid. The defensive stack is overwhelmingly built to notice presence. A file appeared, a process spawned, a connection opened, a signature matched. Almost nothing in a normal SOC is built to notice that something which should have been there was not.
Fire Ant's whole engagement reads as a clinic in it, and the log filter is only the most elegant instance. Sygnia's investigation began with an anomaly on a Cisco IOS XR router: a GRE tunnel interface that was up and running with no running configuration and no commit history explaining how it got there. The tunnel existed. The record of its creation did not. An auditor reconciling config against change history would find an interface with no story, and the only reason anyone caught it is that a human noticed the absence of an explanation rather than the presence of a tunnel.
On the Linux hosts the same instinct repeats. Files deleted after execution, with processes left running from paths that no longer exist. SELinux disabled. Logs tampered with. Firewall rules modified. Every one of those is a subtraction: the binary you would have hashed is gone, the enforcement you would have relied on is off, the record you would have read is thinner than it should be. The running process is the only remaining evidence of a file that no longer exists on disk, and if you reboot to clean up, you destroy your own last artifact.
The Credential Piece, Because It Is Also Clever
On the TACACS server, Sygnia found a toolset they track as TacTap. An injector called acppid loaded a malicious library into the live tac_plus authentication process and hooked the functions that accept new connections, then handed the live session handles to a second process over a local Unix socket. Harvested credentials were written to a dotfile at /var/log/.tacplus.acct, lightly obfuscated with a single-byte XOR of 0xEF.
TACACS is the thing that decides who may log into your network gear. An implant inside the running authentication process does not need to guess passwords or crack hashes, because every legitimate administrator hands it a valid credential on the way past, all day, as designed.
The obfuscation deserves a note. A single-byte XOR is not encryption and was never meant to be. It defeats a grep for a plaintext password and nothing else. That tells you what the operator was actually worried about, and it was not a forensics team — it was a casual look at the filesystem. It also means that if you find that file, it opens trivially.
Fire Ant also used the routers themselves to take packet captures across multiple Cisco devices and pushed them to external FTP servers, one of which appeared to have been stood up the same day the uploads happened. And on Linux hosts, harvested SSH credentials were collected in /var/log/remote.txt as a credential-based fallback alongside the implants. A quiet operator who assumes their own implants will eventually be found builds a way back in that does not depend on them.
Go Hunt This, It Costs Nothing
This is the part that transfers. You do not need our feed or anyone's to run these, and they are cheap.
Look for the shape of the log filter first, because it is the highest-value and nobody checks it. Take a device or host you believe is logging normally, and ask your collector what variety of message types it has received from that source in the last thirty days. A source sending you a healthy volume of events that all belong to one or two templates is the anomaly. Volume looks fine. Diversity has collapsed. If your SIEM can chart distinct event types per source over time, that one chart is worth building today regardless of Fire Ant.
Then look for interfaces with no history. On IOS XR, reconcile active tunnel interfaces against commit history and flag any that exist without a corresponding commit. An interface nobody can explain is worth a call even when it turns out to be a forgotten project.
On Linux management hosts, check for processes running from deleted binaries. Look for the specific artifacts Sygnia named: a dotfile at /var/log/.tacplus.acct and a file at /var/log/remote.txt. Check whether SELinux is enforcing on hosts where policy says it should be. And on TACACS servers specifically, look at what is loaded into the tac_plus process, because that is not a thing that should have unfamiliar libraries mapped into it.
Finally, check your egress for FTP. Packet captures leaving a router to an external FTP server is not subtle traffic, and it is the kind of thing that gets missed only because nobody looks at what network gear itself is uploading.
The Honest Part
We did not find this. Sygnia did, and their report is the primary source for every technical detail in this post. We are writing it because the mechanism matches a pattern we have been tracking and because the hunting guidance above deserves to travel further than a vendor blog usually does.
We hold no first-party indicators on Fire Ant. Our corpus has adjacent Cisco and router-compromise work going back to last November, and nothing on this actor. When we checked our own morning sweep, it had marked this story as already covered on the strength of a keyword match on the word "routers" — which was wrong, and is exactly the false-positive our sweep warns about in its own footer. We opened the receipt, the receipt was about something else, and this turned out to be a genuine gap. The tooling told us to check and we checked.
We cap confidence at 95 percent. Something here is probably wrong, and on a report this fresh the most likely candidate is scope: what Sygnia observed at their clients is not necessarily the full extent of the campaign.
Sources
Sygnia's research on Fire Ant's expansion from hypervisors into trusted infrastructure, plus coverage from The Hacker News and Security Affairs. Read Sygnia's original before you act on our summary of it.
If your log sources all look healthy today, that is either good news or the finding. The chart that tells you which one takes about an hour to build.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=fire-ant-left-the-logging-on-it-just-made-sure-only-the-word-health-got-through-this-is-pattern
Comments