F5 BIG-IP Environment Breached by Nation-State Actor

F5 disclosed a data breach in which a nation-state threat actor gained persistent, long-term access to the company’s product development environment and engineering knowledge management platforms for its BIG-IP products, before exfiltrating data. According to Dark Reading, the breach was disclosed on 15 October and involved exfiltration of some BIG-IP source code as well as information about undisclosed vulnerabilities the actor was mitigating.

The attacker is said to have downloaded files from certain F5 systems and to have accessed a small percentage of customers’ configuration and implementation information within the knowledge management platform. While there is no evidence of access to or exfiltration of data tied to F5’s CRM, financial, support case management, or iHealth systems, nor to the NGINX source code or product development environment, there is also no evidence of modification to the software supply chain.

F5 states it has rotated credentials, strengthened access controls, and deployed enhanced monitoring and detection tools, and that it has coordinated with law enforcement and incident response firms. On 15 October, CISA directed federal civilian agencies to inventory F5 BIG-IP products and apply updates where necessary. according to Dark Reading