Today’s Field Note

Two items worth your attention while everyone else argues about the DoJ’s “targeted vs victim” wording. First, Sygnia says China-nexus Fire Ant has moved off VMware hypervisors and into Cisco IOS XR routers, TACACS servers, and Linux management hosts, the exact layer that authenticates and logs everything else, and they are blinding those logs on the way through. If they own your TACACS and your routers, your detection stack is reporting what they want it to report. Second, PaperCut’s actively exploited flaws now have IDs (CVE-2026-82078 and CVE-2026-81578) and a second emergency patch, which means the first one did not fully close it. Neither of these waits for your change window.

Today’s Action

  • Patch PaperCut NG/MF now to the latest build covering CVE-2026-82078 and CVE-2026-81578, and treat any internet-facing instance as suspect pending review.
  • Audit Cisco IOS XR devices and TACACS servers for unexpected config changes, new local accounts, and gaps in logging that suggest tampering.
  • Pull router and TACACS logs off-box to a location the network gear cannot rewrite, then compare against on-device records for silence.
  • Rotate TACACS shared secrets and device admin credentials, and restrict management-plane access to a hardened jump path.
  • Hunt Linux management hosts for persistence and lateral movement rather than assuming the routers were the only foothold.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Own the routers, own the truth. Verify from somewhere they can’t reach.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.