BridgeAgent

BridgeAgent is a Linux backdoor associated with the China-nexus Fire Ant espionage activity, which has been assessed to overlap with UNC3886 activity. It masquerades as a legitimate Zabbix monitoring agent and establishes root-level persistence through a systemd service. BridgeAgent communicates with attacker-controlled infrastructure over TLS and supports remote command execution, deployment of additional payloads, and TLS-enabled reverse shells. It was deployed on Linux management or staging hosts connected to compromised network infrastructure, enabling durable remote access and post-compromise operations.