A GRE tunnel bound to a VRF is a routed path with its own table, and the report says these tunnels and the outbound Telnet sessions rarely turn up in configurations or history logs [5]. Two conditions make that work. The configuration that builds the tunnel is edited out of what the device returns [4]. And nothing off the box is counting packets. The first condition is documented in the report. The second condition depends on what the operator has already built off-box.
The indicator list, relayed from Sygnia via BleepingComputer, names missing syslog, AAA and SNMP records, discrepancies between `show` output and actual system state, router-originated PCAP and FTP traffic, TACACS credential files, and fake services [10]. Count the on-device channels in that set: syslog, `show`, AAA, SNMP [21]. Every question a NOC puts to the router is inside the compromise. The report's own root-cause section says the same thing in different words, listing reliance on management device displays and the lack of independent validation for TACACS and logging infrastructure next to the code execution itself [13]. A compromised router asked about its own state will always answer, which is exactly the problem here.
The capture path is the cheapest item here to catch. Routers wrote traffic to PCAP files and sent them to external FTP servers to map internal topology and authentication flows [6]. FTP leaving a management address is a connection a policy can deny, which is why isolating the management plane and allowlisting destinations sits first in the recommendations [14].
TacTap injects libraries into `tac_plus` to harvest TACACS credentials [8]. That is collection at the point of authentication, which no client-side control reaches, and it lands next to an accounting file at `/var/log/.tacplus.acct` and a `remote.txt`, with management commands appearing without any login record [11]. If TACACS is both your credential authority and your command audit trail, one host compromise takes the evidence and the keys together [18].
On the Linux side the listed artefacts include `/usr/bin/acpid`, `acppid/libseconfd.so`, `/usr/lib/locate`, `cupsdd`, `smartdd`, deleted running processes, and changes to SELinux and iptables [12]. Note that `cupsdd` and `smartdd` are each one appended character away from a real daemon name [22]. That survives a person reading process output but not a hash comparison, which is why the guidance for these hosts is file integrity monitoring, process injection checks and credential-file hunting [16].
Treat the artefact list as a description of someone else's estate. For those strings to transfer you need `tac_plus` rather than a TACACS appliance, IOS XR in the path, management hosts of the kind the summary names alongside Zabbix [19], and egress that still permits FTP and Telnet from that plane. The mechanism transfers much further than the strings do: any device that reports its own state is a single source of truth, and editing that report is the whole method [4]. Initial access is undisclosed [3], so the available work is validation and containment rather than patching: cross-check run-state, configuration, commits, memory, files and flows against independent sources [15], and treat confirmation as a rebuild from known-good images with credential and trust rotation [17].
The test here is whether last Tuesday's tunnel list can be reconstructed from flow records and a configuration history the device cannot write to. Where that reconstruction is not possible, this indicator list is reading material.
