https://microsegment.io/tags/forensic-readiness/ Recent content in Forensic-Readiness on microsegment.io Hugo en-us Tue, 01 Sep 2026 00:00:00 +0000 https://microsegment.io/post/2026-09-01-when-network-infrastructure-lies/ Tue, 01 Sep 2026 00:00:00 +0000 https://microsegment.io/post/2026-09-01-when-network-infrastructure-lies/ <p>Most security architectures assume the network will tell the truth.</p> <p>The router reports its configuration. TACACS records who administered it. Syslog preserves what changed. The monitoring platform shows which paths were active. During an incident, those records become the timeline.</p> <p>But what happens when the attacker controls the systems that create the evidence?</p> <p><a href="https://www.sygnia.co/blog/fire-ant-evolves-from-hypervisors-to-trusted-infrastructure/">Sygnia&rsquo;s August 2026 Fire Ant investigation</a> describes a China-nexus actor compromising Cisco IOS XR routers, TACACS infrastructure, and Linux management hosts. The actor used routers for covert connectivity and traffic collection, intercepted administrative authentication, maintained persistent access, and manipulated logging and command output.</p>