F5 Breached by APT

THE THREAT

On October 15th, 2025, F5 disclosed that the organization was impacted by a breach involving an unspecified state-sponsored threat actor. The threat actors were able to access and steal data from the BIG-IP product development environment and engineering knowledge management platforms. Customer systems were not impacted in the attack, but configuration and implementation information for “a small percentage of customers” was exfiltrated by threat actors.

This is an actively developing topic. At this time, organizations are strongly encouraged to review all F5 devices for unusual activity and ensure that the latest security patches are deployed.

What we're doing about it

• The eSentire Threat Response Unit is performing threat hunts for activity related to the F5 breach
• The eSentire Threat Response Unit is actively tracking this incident for additional details and detection opportunities
• The eSentire Managed Vulnerability Service (MVS) has plugins to detect the vulnerabilities listed in the F5 security notification

What you should do about it

• Inventory all F5 devices, including BIG-IP hardware, of BIG-IP F5OS, BIG-IP TMOS, Virtual Edition (VE), BIG-IP Next, BIG-IQ software, and BNK/CNF
  • Ensure all F5 devices are up to date on the latest security patches
  • Decommission all F5 devices that have reached End-of-Life (EoL) status
  • Review F5 devices for potential compromise
    • Review F5 Audit logs to identify unusual login activity [KB13426].
    • F5 has sent a threat hunting guide to its customers related to the BRICKSTORM malware

Since discovery of the incident, F5 has taken extensive steps to contain the incident and safeguard its systems. These measures include engaging with leading cybersecurity firms like CrowdStrike and Mandiant, cooperating with law enforcement and government partners, and deploying updates across its product lines—BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients—to mitigate potential vulnerabilities. Additionally, they have introduced a quarterly security notification outlining recent vulnerabilities and the essential patches addressing these threats. The security notification includes 27 high severity CVEs, 16 medium CVEs, 1 low severity CVE, and 1 security exposure. The company emphasizes the urgent need for customers to apply these security patches to prevent possible exploitation, considering the threat actors may possess valuable insights into potential vulnerabilities.

In response to the F5 breach, CISA mandates several immediate actions. US federal agencies must first inventory all F5 BIG-IP hardware and software systems, ensuring that networked management interfaces are not publicly accessible. If any public-facing interfaces are exposed, US federal agencies should adhere to CISA's Binding Operational Directive 23-02 to mitigate the risks. Furthermore, by specified dates in October 2025, US federal agencies must apply the latest updates from F5 for all identified products, ensuring these updates are validated against F5’s MD5 checksums. US federal agencies unable to immediately disconnect devices that have reached end of support must report their rationale and future plans to CISA. Additionally, US federal agencies are required to report their compliance and inventory details to CISA, with initial summaries due by October 29, 2025, and comprehensive inventories by December 3, 2025.

References:

[1] https://my.f5.com/manage/s/article/K000154696
[2] https://my.f5.com/manage/s/article/K000156572
[3] https://my.f5.com/manage/s/article/K13080
[4] https://my.f5.com/manage/s/article/K13426
[5] https://www.cyber.gc.ca/en/alerts-advisories/al25-014-security-incident-impacting-f5
[6] https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices
[7] https://www.tenable.com/blog/frequently-asked-questions-about-the-august-2025-f5-security-incident
[8] https://www.greynoise.io/blog/recent-observations-around-f5
[9] https://www.reuters.com/technology/breach-us-based-cybersecurity-provider-f5-blamed-china-bloomberg-news-reports-2025-10-16/
[10] https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign