Chinese State-Sponsored Hackers Exploit Cisco IOS XR Routers for Hidden GRE Tunnels

According to reporting by BleepingComputer, researchers discovered an active GRE tunnel interface on a Cisco IOS XR router that could not be explained by the running configuration or commit history. The discovery links the activity to Chinese state-sponsored hackers tracked as Fire Ant. The hidden tunnels are believed to serve as persistent remote access and espionage channels, allowing threat actors to maintain access to compromised infrastructure without leaving obvious artifacts in the configuration. The exact method by which the tunnels were established — whether through an undisclosed vulnerability, a misconfiguration, or another vector — remains under investigation. Targets are believed to include telecommunications and critical infrastructure sectors globally. Cisco has not released a specific patch for this tactic at the time of reporting, and the company recommends updating to the latest IOS XR software versions and reviewing tunnel configurations.