When The Network Infrastructure Lies

Most security architectures assume the network will tell the truth.

The router reports its configuration. TACACS records who administered it. Syslog preserves what changed. The monitoring platform shows which paths were active. During an incident, those records become the timeline.

But what happens when the attacker controls the systems that create the evidence?

Sygnia’s August 2026 Fire Ant investigation describes a China-nexus actor compromising Cisco IOS XR routers, TACACS infrastructure, and Linux management hosts. The actor used routers for covert connectivity and traffic collection, intercepted administrative authentication, maintained persistent access, and manipulated logging and command output.

The investigation began with an operational GRE tunnel that had no corresponding running configuration or commit history. The device was doing something its visible configuration could not explain.

That is not just a logging problem.

It is a containment problem, an administrative trust problem, and a forensic architecture problem at the same time.

Trusted Infrastructure Creates A Different Blast Radius

A compromised application server gives an attacker the permissions and paths available to that server.

A compromised router can provide a view across multiple paths. A compromised authentication server can expose administrative credentials as they are used. A compromised jump host can turn an approved management route into an attacker route. A compromised hypervisor can create access below the guest operating system.

These systems are dangerous because other systems depend on them to communicate, authenticate, and record activity.

Sygnia describes this as the “target behind the target” risk. In the investigated environment, Fire Ant used trusted infrastructure to explore reachability into connected high-value networks. The affected routers were not passive transit devices. They became operational platforms for collection, concealment, and access.

The common architecture looks like this:

administrator -> jump host -> TACACS -> router -> connected environments

If all four layers share broad reach, common credentials, and one evidence pipeline, compromise can propagate through the very controls intended to constrain it.

Microsegmentation has to cover the management and evidence planes, not only the workloads behind them.

Separate The Planes Before An Incident

The NSA Zero Trust Network and Environment guidance calls for segmentation and validation of control, management, and data-plane flows. That distinction is practical.

Data plane: the traffic the infrastructure forwards for applications, users, partners, and connected environments.
Control plane: routing, topology, and protocol exchanges that determine how traffic moves.
Management plane: administrative access, configuration, software distribution, backup, and orchestration.
Evidence plane: syslog, AAA records, flow telemetry, packet capture, configuration archives, integrity records, and security alerts.

These planes should not collapse into one trusted network.

An edge router should not initiate arbitrary connections into production or partner environments. A device management interface should not be reachable from general user or server networks. A TACACS server should not double as a general-purpose Linux host. A logging collector should not be administered through the same path and identity used to administer the devices whose activity it records.

CISA’s hardening guidance for communications infrastructure recommends physically separate out-of-band management, dedicated administrative workstations, default-deny access controls, and prevention of lateral management connections between devices. It also recommends securely forwarding AAA logs to centralized logging infrastructure.

The architecture goal is bounded failure:

loss of one router does not provide management access to peer devices;
loss of the data plane does not expose the management plane;
loss of TACACS does not provide a reusable credential path into every infrastructure tier;
loss of one telemetry source does not erase the incident record;
loss of a management host does not create arbitrary outbound reach or access to connected customer, partner, or OT networks.

Do Not Let Routers Manage Routers

One of the most useful details in CISA’s 2025 advisory on state-sponsored compromise of network infrastructure is also one of the easiest to overlook: log and investigate router-to-router logons because they should not be normal administration.

A router may need to exchange routing protocols with peers. That does not mean it should initiate SSH, HTTPS, SNMP, TACACS, or file-transfer sessions to them.

Management policy should allow administrative sessions only from named jump hosts or dedicated administrative workstations. Infrastructure devices should not become management origins simply because they sit inside the management VRF.

For each device class, define:

approved management sources;
required management protocols;
authorized AAA, time, DNS, logging, and telemetry destinations;
permitted software and configuration distribution paths;
emergency access conditions;
explicitly denied outbound management and Internet paths.

Then test the negative paths. Prove that one router cannot administer another. Prove that the management VRF cannot leak routes into customer or peering VRFs. Prove that a device cannot export a packet capture to an arbitrary FTP or HTTPS destination.

CISA’s advisory recommends blocking all management-VRF egress except explicitly authorized AAA, logging, flow-telemetry, and monitoring collectors. That is microsegmentation applied to infrastructure itself.

Give The Evidence An Independent Path

Centralized logging is necessary. It is not sufficient if the compromised device can decide which events to send.

Sygnia found that Fire Ant suppressed router syslog, manipulated command output, hid configuration activity, interfered with AAA and SNMP evidence, and tampered with Linux host logs. The investigation therefore had to compare multiple evidence types rather than trust one console.

Build evidence independence deliberately:

Stream logs off the device in real time. Use authenticated and encrypted transport to a repository the network device cannot administer.
Separate log administration. The identities and workstations that manage routers should not be able to alter the central evidence store.
Collect outside-in telemetry. Flow records, packet sensors, authentication records, hypervisor telemetry, and adjacent enforcement points can reveal activity the compromised device omits.
Archive configurations independently. Compare intended configuration, committed configuration, operational state, routing state, and observed traffic.
Preserve integrity evidence. Record software versions, signed-image status, hashes, boot state, and unexpected changes outside the device itself.
Protect time. Reliable, independently monitored time sources matter when investigators compare events across infrastructure layers.

The NSA guidance recommends centralized repositories with access control, encryption, real-time streaming, integrity protections, and out-of-band management. The design principle is simple: the system being observed must not control the only copy of the evidence.

Segment Authentication Chokepoints

TACACS is valuable because it centralizes authentication, command authorization, and accounting for network administration. That concentration also makes it a high-value target.

Sygnia recovered a toolset it calls TacTap. The malicious components injected into the tac_plus process, intercepted accepted sessions, and created a credential artifact. The actor was not only stealing an administrator’s existing password from an endpoint. It had positioned itself inside the infrastructure that processed administrative authentication.

Treat TACACS and RADIUS servers like Tier 0 systems:

run them on dedicated, hardened hosts;
allow client connections only from enrolled infrastructure devices;
allow administration only from dedicated privileged paths;
prevent general outbound Internet access;
isolate backups, package sources, and monitoring flows;
avoid credential overlap between network and server administration;
monitor the service process, loaded libraries, listening sockets, and changes to authorization policy;
keep a constrained, audited break-glass path that does not depend on the primary AAA service.

MITRE ATT&CK’s Network Devices coverage recommends signed software images, boot integrity, protected credentials, least privilege, and avoiding privileged credential overlap between network and non-network platforms. Those controls reduce the chance that one administrative compromise crosses infrastructure tiers.

Network identity should be segmented by function as carefully as network traffic.

Test Whether The Infrastructure Can Lie

Most network audits compare the running configuration with a standard.

That test assumes the running configuration is an honest representation of operational state.

Add adversarial validation that starts with a compromised infrastructure component:

Assume one edge router is fully controlled.
Attempt to reach peer management interfaces, jump hosts, AAA, configuration repositories, and connected environments.
Attempt outbound tunnelling, packet-capture export, and unexpected management protocols.
Compare the device’s visible configuration with external flow telemetry and packet observation.
Generate administrative actions and verify that independent AAA and logging systems record them.
Remove or alter one telemetry source and confirm that the remaining sources expose the gap.
Rebuild a device from trusted media and verify that configuration, software, keys, and credentials are not restored from a compromised source.

The NSA guidance calls for isolation testing to verify that flows remain segmented according to policy. Fire Ant shows why the same verification must include evidence integrity. A deny rule is not proof if the enforcement point and the console reporting it are both under attacker control.

Containment Needs An Independent Witness

The network is not neutral infrastructure. It is a privileged execution environment that routes traffic, sees authentication, connects organizations, and decides what defenders can observe.

That makes routers, TACACS servers, jump hosts, hypervisors, and telemetry platforms part of the breach-containment architecture.

Protect them with narrow management paths. Prevent peer-to-peer administration. Restrict outbound connectivity. Separate infrastructure identities. Stream evidence to independently administered systems. Validate operational state from outside the device.

When a normal workload is compromised, segmentation limits where the attacker can go.

When the segmentation infrastructure is compromised, independent boundaries and independent evidence determine whether defenders can still understand what happened.

If the infrastructure can lie, your incident response needs another witness.

Sources

This article was generated with the assistance of AI and reviewed by the author.

microsegment.io