Loading story…
F5 disclosed that a state-sponsored intruder maintained long-term access to its environment and stole sensitive data including BIG-IP source code, details of reported but not yet patched or disclosed vulnerabilities, and configuration and implementation information for a limited number of customers. Reporting attributed the intrusion to the China-linked group UNC5221, which allegedly used the BRICKSTORM backdoor and remained in the environment for more than 12 months. F5 said the incident did not involve a supply-chain compromise and did not affect CRM, financial systems, customer support, iHealth, or systems tied to other product lines.
Mandiant separately published hunting guidance describing BRICKSTORM as a stealthy espionage backdoor deployed on edge devices and appliances, with operators pivoting into enterprise environments through suspicious outbound traffic, appliance management interfaces, Windows Type 3 logons, occasional RDP, Microsoft 365 mail access abuse, and VMware vCenter or ESXi account manipulation. Defenders were urged to scan appliance files and backups with YARA and a Linux/BSD appliance scanner, review logs for rare DNS-over-HTTPS activity, inspect Windows User Access Logs, and check vCenter audit trails for temporary local accounts used to install BRICKSTORM. F5 said it rotated cryptographic material and released updates for BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients to address 44 vulnerabilities, including the leaked issues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In response to the intrusion, F5 said it worked with Mandiant, CrowdStrike, NCC Group, and IOActive, rotated cryptographic material, and released security updates. The updates covered BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients and addressed 44 vulnerabilities, including leaked ones.
Bloomberg attributed the F5 intrusion to the China-linked group UNC5221 using BrickStorm malware, with reported dwell time of more than 12 months. The attribution connected the F5 breach to the broader BRICKSTORM espionage activity.
F5 confirmed it was the victim of a cyberattack in which a state-sponsored group had long-term access to its systems and exfiltrated sensitive data, including BIG-IP source code, information on unpatched or undisclosed vulnerabilities, and limited customer configuration details. F5 said there was no supply-chain compromise and that CRM, financial, customer support, iHealth, and other product-line systems were not affected.
Mandiant published detection and hunting guidance for the BRICKSTORM backdoor, including YARA-based file and backup scanning and a scanner script for Linux/BSD-based appliances. The guidance also described actor tradecraft such as pivoting from appliances into Windows systems, suspicious Microsoft 365 mailbox access, and creation and deletion of local vCenter or ESXi accounts to install BRICKSTORM.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 Networks confirmed that unidentified threat actors gained unauthorized access to its internal systems, resulting in the theft of files containing portions of BIG-IP source code and information about undisclosed vulnerabilities in the product. The breach was discovered on August 9, 2025, but evidence suggests that the attackers had maintained access to F5’s network for at least a year prior to detection. The attackers reportedly used a malware family known as BRICKSTORM, which has been attributed to a China-linked espionage group identified as UNC5221. This sophisticated intrusion highlights the ongoing targeting of edge infrastructure and security vendors by state-sponsored actors, who recognize the strategic value of such platforms in global networks. Following the breach, security researchers observed increased scanning activity targeting F5 BIG-IP devices on September 23, October 14, and October 15, 2025, although it remains unclear if these scans were directly related to the incident. Censys reported that over 680,000 F5 BIG-IP load balancers and application gateways are exposed on the public internet, with the largest concentrations in the United States, Germany, France, Japan, and China. Not all of these systems are necessarily vulnerable, but their public exposure increases the risk of exploitation. Security experts have emphasized the need for organizations to inventory, restrict access to, and proactively patch these devices to mitigate potential threats. The breach underscores the persistent risk posed by long-term, stealthy intrusions, particularly those orchestrated by nation-state actors. F5’s disclosure has prompted renewed calls for vigilance and improved security practices among organizations relying on edge devices. The incident also serves as a reminder that even companies specializing in security solutions are not immune to advanced persistent threats. Industry analysts have warned that the exposure of source code and vulnerability information could facilitate further attacks against F5 customers if not addressed promptly. Organizations using F5 products are advised to monitor for unusual activity, apply security updates, and review their network segmentation strategies. The breach has contributed to broader concerns about the security of network edge devices, which are increasingly targeted due to their critical role in enterprise infrastructure. F5’s response and ongoing investigation will be closely watched by the cybersecurity community as more details emerge about the scope and impact of the compromise.
Jun 29, 2026
F5, a major application delivery and security provider, disclosed a significant breach in which malicious actors maintained persistent access to critical systems, including the BIG-IP product development environment and engineering knowledge management platform. The breach, which began in August and was deemed material by September, prompted F5 to delay public notification due to national security concerns. Upon disclosure, F5 released security patches for affected products, and CISA issued an emergency directive requiring federal agencies to patch vulnerable F5 devices immediately. The advanced 'Brickstorm' malware, attributed to Chinese threat actors, was detected as part of this breach, raising concerns about the potential for long-term exploitation of stolen technical specifications and code. While there is currently no evidence that the stolen information has been used to exploit F5 devices or alter the codebase, the incident highlights the ongoing risks associated with software supply chain attacks. The breach underscores the challenges organizations face in securing complex supply chains, as even widely adopted security frameworks may not fully mitigate such threats. The F5 incident draws parallels to previous high-profile supply chain compromises, emphasizing the need for more robust and comprehensive security measures to protect critical infrastructure and sensitive data from sophisticated nation-state actors.
Jun 29, 2026
F5 confirmed that a nation-state threat actor gained persistent access to its internal systems, resulting in the theft of *BIG-IP* source code, customer configuration data, and information on 44 vulnerabilities. The company stated that only a small number of customers were affected, all of whom have since applied emergency updates, and emphasized that the stolen data was not sensitive and that customer operations experienced minimal disruption. F5 has responded by expanding its bug bounty program and partnering with CrowdStrike to enhance endpoint detection and response (EDR) capabilities for *BIG-IP* systems, while external cybersecurity firms IOActive and NCC Group found no critical flaws in the stolen code. Despite F5's assurances that the incident is contained and the impact is limited, some independent researchers have raised concerns about the company's transparency and the true extent of operational control and reputational damage. The breach, discovered in August and disclosed in October, also triggered a federal emergency directive. F5 maintains that the incident has not significantly affected its business outlook, projecting up to 4% revenue growth in fiscal 2026, but scrutiny continues regarding the adequacy of its response and communication with stakeholders.
Jun 29, 2026