When Fire Ant compromised Cisco IOS XR routers and TACACS servers in 2026, investigators didn't find the evidence in logs. The logs had been altered. They found it in memory dumps, configuration deltas with no commit history, and process trees that didn't match what the filesystem showed.
This checklist helps you treat network infrastructure as forensic evidence, not just operational plumbing. It's designed for environments where routers, authentication servers, and management hosts handle privileged access to high-value networks.
What This Checklist Covers
You'll validate whether your network devices can withstand forensic scrutiny during an incident. Can you reconstruct what happened when the attacker controls the device and has suppressed the telemetry you'd normally rely on?
The checklist assumes you're responsible for environments where credential theft, traffic interception, or lateral movement through trusted network paths would create material risk. It doesn't replace your existing security hardening guides. It complements them by asking: what evidence would remain if an adversary spent months inside your routers?
Prerequisites
Before you start, confirm you have:
- Administrative access to routers, TACACS+ servers, and Linux management hosts
- Read access to configuration management systems, commit histories, and change control records
- Ability to collect memory dumps from network devices without disrupting production traffic
- Baseline inventories of running processes, loaded libraries, and persistence mechanisms on Linux hosts
- Network flow telemetry independent of the devices being validated (NetFlow from upstream aggregation points, not from the router itself)
If you don't have these, your first step is securing them. You can't validate evidence integrity without a second source of truth.
Checklist
1. Router Configuration Integrity
Done when: Every interface, tunnel, and routing protocol has a corresponding commit record in your configuration management system, and no interface exists in the running configuration without a commit history to explain it.
What good looks like: You run show running-config on a Cisco IOS XR router and cross-reference every GRE tunnel, every access control list, and every administrative interface against Git commits or change tickets. Nothing appears that wasn't explicitly deployed. If an interface exists with no history, you've found an anomaly worth investigating.
2. Command Output Filtering Validation
Done when: You've confirmed that show commands return unfiltered output and that no process is intercepting or modifying command execution paths.
What good looks like: You inspect the command-execution libraries and verify that no | exclude filters are being appended automatically. On IOS XR, this means checking /pkg/bin/ for modified binaries. Fire Ant altered the show command path to hide tunnel configurations from administrators. Your validation should catch this by comparing binary hashes against known-good versions from Cisco or by running commands from a known-clean console session and comparing output.
3. Log Forwarding Completeness
Done when: Every syslog message, SNMP trap, and authentication event generated by the router reaches your SIEM without suppression, and you've validated this with synthetic test events.
What good looks like: You generate a test authentication failure and a test configuration change. Both appear in your centralized logging within 60 seconds. Then you inspect the router's logging libraries to confirm no filtering logic exists. Fire Ant embedded a library that only forwarded logs containing specific strings. You're checking for that exact tradecraft.
4. TACACS+ Credential Protection
Done when: The tac_plus authentication process is running without injected libraries, no unauthorized files exist in /var/log/, and you've confirmed no process is hooking connection-acceptance functions.
What good looks like: You use lsof to list all libraries loaded by the tac_plus process. Every library matches your baseline. You check for files like /var/log/.tacplus.acct (the credential file Fire Ant used, obfuscated with XOR key 0xEF). You inspect the process tree for any Unix socket connections to secondary processes that shouldn't exist. If you find a library named something like libseconfd.so that wasn't deployed by you, you've found TacTap or a variant.
5. Memory vs. Disk Process Validation
Done when: Every running process on Linux management hosts has a corresponding binary on disk, and no process is running from a deleted file.
What good looks like: You run ls -l /proc/[pid]/exe for every process and confirm the symlink points to an existing file. Fire Ant kept backdoors running in memory after deleting the binaries from disk. If you see (deleted) next to a process name, investigate immediately. Then compare process names against expected baselines. Fire Ant disguised a backdoor as /usr/bin/gnome-shell on a headless server. That's a red flag.
6. Persistence Mechanism Inventory
Done when: You've cataloged every systemd unit, init script, cron job, and startup hook on management hosts, and every entry has a documented business purpose.
What good looks like: You list all systemd units with systemctl list-unit-files and inspect /etc/rc.d/init.d/ for scripts like grub-rommon that don't belong. Fire Ant used a zabbix_agent.service unit to persist BridgeAgent while masquerading as monitoring software. Your inventory should flag services that reference binaries in unusual paths or services running as root without justification.
7. SELinux and Audit Subsystem Status
Done when: SELinux is enforcing on all Linux hosts, audit logs are immutable, and you've confirmed no actor has disabled protections.
What good looks like: getenforce returns Enforcing. The audit log at /var/log/audit/audit.log has the immutable attribute set (lsattr). Fire Ant disabled SELinux to reduce forensic artifacts. If you find SELinux in permissive mode on a production host, treat it as a potential compromise indicator and investigate who changed it and when.
8. Packet Capture Activity
Done when: You've confirmed no unauthorized PCAP collection is running on routers or management hosts, and no FTP uploads to external servers have occurred.
What good looks like: You check for running tcpdump or vendor-specific capture processes. You inspect outbound FTP logs and firewall rules for connections to IP addresses you don't recognize. Fire Ant uploaded PCAPs to external FTP servers, some of which were stood up the same day as the upload. Your netflow data should show no sustained FTP sessions to unexpected destinations.
9. Authentication Log Integrity
Done when: Login history in /var/log/wtmp, /var/log/btmp, and /var/log/secure matches your authentication server records, with no unexplained gaps or timestamp anomalies.
What good looks like: You run last and lastb and cross-reference the output against your TACACS+ server logs. Every privileged login has a corresponding entry in both places. Fire Ant rewrote login-history records and removed entries for privileged commands. If you see logins in TACACS+ that don't appear in local logs, or if timestamps don't align, you've found evidence of tampering.
10. Rootkit Detection
Done when: You've scanned for known rootkits (Medusa, REPTILE) and verified that kernel modules, hidden processes, and network backdoors aren't present.
What good looks like: You run rkhunter or chkrootkit and review kernel module lists with lsmod. Fire Ant deployed Medusa and REPTILE rootkits for persistent access. You're looking for kernel modules that weren't installed by your OS vendor, processes that don't appear in ps but show up in /proc/, and network listeners on unusual ports.
Common Mistakes
Trusting a single telemetry source. If the actor controls the router, they control the logs. Sygnia's investigation succeeded because they validated logs against memory, disk, network flow, and configuration evidence. Don't assume syslog is complete.
Treating routers as appliances, not computers. Routers run operating systems. They have filesystems, process tables, and libraries. Fire Ant modified system libraries and command-execution paths. Your forensic approach should mirror what you'd do for a compromised server.
Skipping memory analysis. Fire Ant kept backdoors running after deleting files. If you only look at disk, you'll miss active threats. Collect memory dumps during incidents.
Assuming endpoint agents protect infrastructure. Fire Ant impersonated SentinelOne and Cybereason binaries. Endpoint agents often don't run on routers or TACACS servers. Your infrastructure layer needs dedicated validation.
Next Steps
Run this checklist quarterly, or immediately after any unexplained configuration change, authentication anomaly, or network performance issue on high-value infrastructure.
If you find evidence of compromise, treat the device as forensic evidence first and operational infrastructure second. Don't reboot or reload configurations until you've collected memory, disk, and network telemetry. Sygnia published YARA rules and indicators of compromise in their report. Use them.
The strategic lesson: when an adversary controls your routers, they don't just gain reach. They gain perspective over every credential, every session, and every packet moving through trusted paths. Your checklist should assume the logs are already compromised and work backward from there.
