F5 Hack: Attack Linked to China, BIG-IP Flaws Patched, Governments Issue Alerts

SecurityWeek reports that the F5 attack is linked to China, with government alerts issued after patches were released for a large batch of BIG-IP vulnerabilities. The company said the attackers, whose presence was discovered on August 9, accessed and exfiltrated some files, including the BIG-IP source code and information on undisclosed vulnerabilities, while denying evidence of supply chain tampering.

Google Threat Intelligence Group and Mandiant have linked the Brickstorm activity to a threat actor tracked as UNC5221, and researchers have noted the attackers dwelled in F5 networks for at least 12 months. More than two dozen patched flaws are rated high severity and can be used to bypass security measures, escalate privileges, or cause DoS; many can be exploited remotely without authentication, while others require authentication or elevated privileges.

Cybersecurity agencies in the United States and the United Kingdom issued alerts, with CISA warning that the theft of source code and vulnerability data poses an imminent threat to federal networks using F5 devices, according to Bloomberg, and the UK’s NCSC providing parallel recommendations.