TACACS and authentication infrastructure theft

Fire Ant taught a Cisco IOS XR router to forward only log lines containing the word Health

Sygnia found the China-nexus group running packet captures, a tac_plus credential hook and two layers of log suppression on the gear that authenticates the rest of the estate, and it never established how the router was breached.