S0:E29 — The GRE Tunnel That Wasn't in the Config
Sygnia published new research on Fire Ant, a threat actor they first tracked in 2025 around hypervisor espionage against vCenter and ESXi. The new report covers something rarer: live compromise of Cisco IOS XR network devices, discovered because a responder noticed a GRE tunnel in network monitoring that didn't exist in the running config and left no trace in the logs. Jess and Jake walk through what that means for defenders, why IOS XR being Linux-based changes the economics of building a backdoor, and why "compromised network devices" remains one of the most underappreciated categories of…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.