F5 confirms source code likely stolen by nation-state hackers
Patch before 22nd October, CISA warns US agencies
The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of an ongoing threat to F5 applications and appliances.
On Wednesday CISA issued an emergency directive to US government bodies, warning that a nation-state threat actor poses an “immediate risk to federal networks.”
The threat group is “targeting federal networks utilising certain F5 devices and software,” CISA stated, ordering all agencies to apply the latest updates for at-risk systems including F5OS, BIG-IP TMOS, BIG-IQ and BNK / CNF, by 22nd October.
The directive follows a disclosure by F5 of a breach by an unnamed state-sponsored espionage group that breached its BIG-IP product development environment and knowledge management platforms. The breach was discovered in August but disclosure was delayed until 12th September because of national security concerns.
In a bulletin that was updated on Friday, F5, a cybersecurity and application delivery company based in Seattle, confirmed that systems including the BIG-IP product development environment and engineering knowledge management platforms had been affected, including the theft of source code, and said it was taking action to contain the threat actor.
“We have confirmed that the threat actor exfiltrated files from our BIG-IP product development environment and engineering knowledge management platforms. These files contained some of our BIG-IP source code and information about undisclosed vulnerabilities we were working on in BIG-IP.”
The bulletin continues: “We have no evidence of access to, or exfiltration of, data from our CRM, financial, support case management, or iHealth systems. However, some of the exfiltrated files from our knowledge management platform contained configuration or implementation information for a small percentage of customers.”
In relation to the breach, F5 released more than 30 Common Vulnerabilities and Exposures (CVEs) on 15th October, with severity scores ranging from 7.7 to 8.7.
As key components of many enterprise and government networks, F5’s BIG-IP load balancing and application delivery appliances and software and related solutions have been targeted before.
In 2022, threat actors used a BIG-IP bug to wipe files on endpoint devices, and in 2024 it was revealed that China-linked hackers had established a presence on BIG-IP appliances and had likely been exfiltrating data for years.