Sygnia researchers discover that the Chinese threat actor known as Fire Ant has shifted its focus from VMware hypervisors to Cisco routers, TACACS authentication servers, and Linux management hosts. The investigation begins after analysts find an active GRE tunnel interface on a Cisco IOS XR router that the running configuration