UNC5221 Used BRICKSTORM to Steal F5 BIG-IP Source Code and Vulnerability Data

F5 disclosed that a state-sponsored intruder maintained long-term access to its environment and stole sensitive data including BIG-IP source code, details of reported but not yet patched or disclosed vulnerabilities, and configuration and implementation information for a limited number of customers. Reporting attributed the intrusion to the China-linked group UNC5221, which allegedly used the BRICKSTORM backdoor and remained in the environment for more than 12 months. F5 said the incident did not involve a supply-chain compromise and did not affect CRM, financial systems, customer support, iHealth, or systems tied to other product lines.

Mandiant separately published hunting guidance describing BRICKSTORM as a stealthy espionage backdoor deployed on edge devices and appliances, with operators pivoting into enterprise environments through suspicious outbound traffic, appliance management interfaces, Windows Type 3 logons, occasional RDP, Microsoft 365 mail access abuse, and VMware vCenter or ESXi account manipulation. Defenders were urged to scan appliance files and backups with YARA and a Linux/BSD appliance scanner, review logs for rare DNS-over-HTTPS activity, inspect Windows User Access Logs, and check vCenter audit trails for temporary local accounts used to install BRICKSTORM. F5 said it rotated cryptographic material and released updates for BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients to address 44 vulnerabilities, including the leaked issues.