Breach of F5 requires “emergency action” from BIG-IP users, feds warn

Thousands of networks, including many run by the US government and Fortune 500 firms, face an imminent threat after F5 disclosed a breach of its BIG-IP ecosystem. F5 said a sophisticated threat group operating for an undisclosed nation-state government had lingered in its network for a long period and gained access to the update-building pipeline, customer configurations, and private source code related to unpatched vulnerabilities.

The company added that investigators had yet to find evidence of supply-chain attacks, while two outside firms attested that no modifications to in-scope items were detected. According to CISA, federal agencies must immediately take inventory of all BIG-IP devices and install updates, with a threat-hunting guide to be followed; the UK’s National Cyber Security Centre issued a similar directive.

The warning notes the potential for supply-chain attacks and credential abuse, and F5 confirmed that two days ago BIG-IP signing certificates were rotated, though there was no immediate confirmation that the move was in response to the breach. Ars Technica describes the risk as widespread, given that BIG-IP devices sit at the edge of many networks that govern web traffic and security.