F5 Blames Nation-State Hackers for Theft of Source Code and Vulnerability Data

F5 has not disclosed many details about the threat actor, but the attack profile suggests a nation-state intrusion, with the company stating in an SEC filing that the hackers maintained long-term, persistent access to some systems, including those linked to the BIG-IP platform.

The assailants exfiltrated files containing BIG-IP source code and information on undisclosed vulnerabilities, though F5 says it is not aware of any non-public vulnerabilities that are critical or remotely exploitable, and there is no evidence of exploitation of undisclosed flaws. According to F5, there is no evidence of modifications to the software supply chain, including the source code and build and release pipelines, nor of access to or alteration of the NGINX source code or product development environments.

The attackers are also not believed to have accessed data from the company’s CRM, financial, iHealth, or support case management systems. The incident was detected on 9 August, and a DOJ clearance allowed a delay in disclosure; the company notes the incident has not had a material impact on operations as it continues to assess potential financial effects.

Publicly, the attack profile points to China as the potential threat actor, with Chinese state-sponsored hackers historically targeting major software companies to uncover undisclosed vulnerabilities.