Fire Ant taps the server that answers every login
The tac_plus binary hashed clean. Nothing had replaced it and nothing had patched it, so file integrity monitoring stayed green through the whole intrusion, while inside the live process a library already unlinked from disk copied every credential the devices presented on their way to authentication.
That detail from Sygnia's August 2026 Fire Ant reporting is why this post is about an authentication server and not the CVSS 10.0 firewall bug that put the same actor's target class on a federal clock.
The crew that stopped bothering with endpoints
Fire Ant is a China-nexus espionage group whose activity overlaps heavily with UNC3886, the cluster Mandiant tracks for VMware and edge-device intrusions, and no MITRE ATT&CK group ID has been assigned to it. Sygnia named it in July 2025 for compromising ESXi and vCenter, then reported in August 2026 that the group had moved into the network and management layer, hijacking Cisco IOS XR routers, TACACS+ servers, and Linux management hosts across telecom, critical infrastructure, and defense (The Record). The motive is long-term espionage access rather than extortion. Fire Ant wants the devices that route, authenticate, and manage everything else, and it wants them quietly enough to stay for years.
A tap inside the process that answers every login
Sygnia tracks the TACACS+ credential collection toolset as TacTap, and precision matters, because this is neither a trojanized daemon nor a configuration change. An injector at /usr/sbin/acppid loads a library, /lib/libseconfd.so, into the running tac_plus process, where it hooks the accept and accept4 calls the daemon uses to take new TACACS+ connections, handing the operator a live view of every authentication session crossing the server. The injector then deletes the library from disk. Session descriptors pass to the collector over a Unix socket at /var/run/acpid.lock, and harvested credentials land in /var/log/.tacplus.acct under a single-byte XOR key of 0xEF (The Hacker News).
The primitive is old. Where it was pointed is what matters, because a TACACS+ server is the one box that legitimately sees every administrator credential for every switch, router, firewall, and controller authenticating against it, in the clear, at the moment of use. TACACS+ encrypts the session on the wire and did what it advertises. Fire Ant waited until after decryption.
Two defensive assumptions break at once. File integrity monitoring asks about the disk, and the binary is untouched while the interception library is already gone. Rotation fares no better, because a password rotated against a tapped server crosses the same hook on first use.
How new this actually is
Sygnia's wording is careful and I am keeping it that way: to their knowledge, this specific tac_plus library-injection technique has not been publicly described before. That is a claim about the public record of this technique against this daemon, not a claim that process injection is new. Call it a known primitive aimed at a target class nobody had documented it against.
MITRE shows the same gap. T1556 Modify Authentication Process carries nine sub-techniques and the closest two describe something else: T1556.003 covers Pluggable Authentication Modules, while these hooks sit in the daemon's connection handling, and T1556.004 covers patching a magic password into a system image. Neither fits a library injected into an AAA daemon, which is why our BASzy profile binds this step to the parent technique.
Four CVEs, one management plane
TacTap is post-compromise work. Fire Ant still has to arrive, and these are the flaws that get it there.
| CVE | Product | How Fire Ant uses it | KEV status | Source |
|---|---|---|---|---|
| CVE-2026-20079 CVSS 10.0 |
Cisco Secure FMC, on-premises web UI | A boot-time process leaves a partial csm_processes session in sfsnort.sessions when nobody logs in after a reboot. That orphaned session is upgraded to call root CGI scripts with no credentials. Web shells follow. |
KEV September 9, 2026, deadline September 12 | Cisco advisory, CISA KEV |
| CVE-2023-34048 CVSS 9.8 |
VMware vCenter Server, DCERPC | Unauthenticated out-of-bounds write giving code execution on vCenter and a path to the ESXi hosts beneath. Mandiant found UNC3886 using it as a zero-day since late 2021. | KEV listed | Mandiant |
| CVE-2023-20867 CVSS 3.9 |
VMware Tools, host to guest operations | Runs commands inside guest VMs from a compromised ESXi host with no guest credentials, below the guest OS. | Not KEV, post-compromise only | Mandiant |
| CVE-2022-41328 CVSS 7.1 |
Fortinet FortiOS, CLI path traversal | Writes outside the intended directory on FortiGate to plant edge persistence. | KEV listed | Mandiant |
One caveat on attribution: Cisco tied the observed CVE-2026-20079 exploitation to three post-compromise clusters, UAT-12197, UAT-11823, and UAT-11988 (SecurityWeek). They sit inside Fire Ant's target class, but have not been named as Fire Ant.
Severity ranking puts the wrong box first
Sort those four by base score and you get 10.0, 9.8, 7.1, 3.9, which misleads in two directions. CVE-2023-20867 is the lowest number and the one that touches your workloads, letting an operator who already owns the hypervisor execute inside guest VMs with no guest credential, underneath the guest security stack. A 3.9 that runs below your EDR was scored against the wrong trust boundary.
CVE-2026-20079 has the opposite problem, where the 10.0 is accurate and the queue still mishandles it, because a base score cannot tell the FMC answering the internet from the one answering a single jump host. VulnCheck notes Censys finding roughly 300 instances publicly exposed, with FOFA counting 600 to 700. The technique at the center of this post has no CVE at all.
What TRIS does with a TACACS+ server
TRIS, the Threat and Risk Intelligence Scoring engine inside CVEasy AI, scores a finding against the asset it sits on. Four layers decide these.
Exploitation status. CVE-2026-20079 is confirmed exploited in the wild: Cisco PSIRT became aware in August 2026, Talos confirmed publicly on September 9, and CISA added it to KEV that day (BleepingComputer). A proof of concept says the bug is real, in-the-wild abuse says somebody is spending it, and TRIS weighs those differently.
Reachability. An FMC whose web interface answers the internet sits in the top ACT band. The same build behind a jump host drops several bands, with nothing about the vulnerability changed.
Credential concentration. This layer moves a TACACS+ server up the queue in a week when nothing on it has a CVE, because it brokers administrative authentication for every device pointed at it.
Blast radius. FMC manages Firepower Threat Defense devices and vCenter manages the hosts beneath it, so TRIS scores a manager against the fleet it controls, not as one more host.
One CVE therefore lands in different bands across a single estate on the same afternoon. An exposed instance earns ACT, a segmented one sits far lower in the same queue, and the CVSS beside them is identical.
Hunt for this before Friday
Start on the AAA servers, where nothing in your existing tooling will raise its hand.
Compare loaded libraries against the disk. For the running tac_plus process, read /proc/<pid>/maps for file-backed mappings marked deleted. A library resident in memory with no file behind it is the artifact.
Hunt the documented paths. /usr/sbin/acppid, /lib/libseconfd.so, /var/run/acpid.lock, and /var/log/.tacplus.acct. A hit on an AAA server means incident response. Audit rules covering ptrace against tac_plus, and writes into /var/log from outside the logging stack, catch the technique rather than this one toolset.
Reconcile device logs against an external collector. One component forwarded a log line only when it contained the string Health, so the collector keeps receiving a reassuring heartbeat while the rest is dropped. Sygnia also found SELinux disabled, iptables redirecting inbound port 22 to 443, and wtmp, utmp, and btmp rewritten to hide the router's real address.
Diff runtime state against commit history on IOS XR. This campaign surfaced because an investigator found an active GRE tunnel that neither the running configuration nor the commit history could explain, so treat any tunnel with no commit behind it as an implant. On management hosts, check unfamiliar systemd units: BridgeAgent persisted as root under one named zabbix_agent.service.
Patch targets and what to rotate
Patch on-premises Cisco Secure FMC to the fixed release named in Cisco's advisory. The federal deadline passed on September 12. Cisco published that advisory on March 4, 2026 with no evidence of exploitation, so the gap between disclosure and confirmed abuse ran about five months, and that is the interval most estates spent leaving a management appliance alone.
If vCenter, VMware Tools, or FortiOS still carry CVE-2023-34048, CVE-2023-20867, or CVE-2022-41328, those are three-year-old flaws that a state-sponsored group is documented as using. Get the management interfaces off the internet as well, bind them to a management network behind a jump host, and restrict source addresses to named administrators.
Above all, treat exposure as compromise rather than a finding you closed. An FMC or vCenter left exposed through August and September deserves investigation before you trust it again, and logs belong on a collector the device cannot reach back into, because this actor's evasion depends on editing the record.
What CVEasy AI does with this one
CVEasy AI, the number one local-first CTEM platform, ingests the real sources behind this post and runs them through TRIS against your inventory on your own hardware, so the FMC on your management VLAN and the one somebody stood up in a lab with a public address stop sharing a score. BASzy replays this actor's eleven-step kill chain in authorized engagements, so you learn whether the path is reachable before someone else does.