⚡ Weekly Recap: F5 Breached, Linux Rootkits, Pixnapping Attack, EtherHiding & More

The weekly recap highlights a nation-state–level breach of F5, with attackers reportedly stealing BIG-IP source code and information about undisclosed vulnerabilities after infiltrating the network for at least 12 months, using a malware family dubbed BRICKSTORM and attributed to a China-nexus group named UNC5221.

GreyNoise observed elevated scanning activity in three waves on September 23, 2025, October 14, and October 15, 2025, though researchers cautioned the anomalies may not be linked to the hack, while Censys identified over 680,000 publicly reachable F5 BIG-IP devices, mainly in the U.S.

The Top News section also covers North Korean threat actors using EtherHiding to distribute malware and steal cryptocurrency, linked to UNC5342 (Famous Chollima), in a campaign named Contagious Interview, which has used LinkedIn and Telegram/Discord to lure victims. Other notable items include LinkPro Linux rootkit, which deploys two eBPF modules and activates via a magic TCP packet, and a Cisco IOS/IOS XE campaign codenamed Zero Disco exploiting CVE-2025-20352 to deploy rootkits on older devices.

Pixnapping, CVE-2025-48561, targets Android 2FA and data, with Google patches issued in September 2025. According to The Hacker News, these threat clusters underscore long-term, targeted abuses across edge, mobile, and network infrastructure.