Loading story…
F5 published guidance and a Python-based indicator-of-compromise checker to help administrators investigate suspected compromise of BIG-IP devices exposed to the TMUI remote code execution flaw CVE-2020-5902. The tool is designed to run locally as root in Advanced Shell and reviews logs, configuration files, startup locations, web directories, and temporary directories for artifacts linked to post-exploitation activity, including possible webshells, startup backdoors, and suspicious files created after known exploitation began.
F5 warned that the checker is only an investigative aid and cannot prove a system is clean, because attackers with root-level access may delete evidence or tamper with binaries. The company said findings require manual verification, noted that false positives are possible, and advised organizations that are unsure about a device’s integrity to treat it as compromised and follow incident-response procedures; on BIG-IP 13.1.0 and later, the tool can also use sys-eicheck to compare the running system against original RPMs for integrity validation.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
F5 released a Python-based indicator-of-compromise detection tool for BIG-IP systems to help identify artifacts associated with exploitation of the TMUI remote code execution vulnerability CVE-2020-5902. The repository includes guidance that the script should be run locally as root on the target device and that findings require manual verification.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **`CVE-2025-53521`** to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a flaw in **F5 BIG-IP Access Policy Manager (APM)**. The vulnerability affects BIG-IP **17.x, 16.x, and 15.x** when an APM access policy is configured on a virtual server, and specially crafted unauthenticated traffic can crash and restart the **TMM** process, creating a path to potential **root-level remote code execution**. F5 had initially treated the issue as a denial-of-service bug, but reclassified it as **RCE** after new information emerged, sharply raising the severity of the threat. F5 said fixes were released in February 2025, with patched versions including **17.1.0.4**, **16.1.4.3**, and **15.1.10.2** or later, and warned that end-of-technical-support systems should be considered unprotected. CISA ordered Federal Civilian Executive Branch agencies covered by **BOD 22-01** to remediate by **March 30, 2026**, while urging organizations to assess internet-exposed F5 devices, review F5-published indicators of compromise and attacker tradecraft, and investigate for signs of intrusion. Reporting also noted the KEV listing comes after F5's earlier nation-state compromise, which allegedly exposed source code and undisclosed vulnerability information.
Jun 29, 2026
F5 disclosed a critical flaw in the **BIG-IP iControl REST** interface, tracked as **`CVE-2022-1388`**, that allows attackers to bypass authentication and achieve unauthenticated remote code execution on exposed administrative interfaces. The issue affects the interaction between Apache and the iControl REST service, where crafted requests abusing headers such as **`X-F5-Auth-Token`** and **`Connection`** can reach privileged command-execution functionality without valid credentials. The vulnerability carries a **CVSS 9.8** rating and impacts multiple BIG-IP versions, prompting F5 to publish patches and mitigation guidance. Technical analysis showed the bug stems from request-handling logic that lets specially formed traffic evade normal authentication checks and invoke sensitive endpoints. Security reporting also indicated the flaw was being **actively exploited in the wild**, with thousands of potentially vulnerable internet-exposed BIG-IP systems observed, increasing the risk to organizations using the platform for application delivery and security services. Defenders were urged to patch affected devices quickly or apply F5’s recommended mitigations to restrict exposure of the management interface.
Aug 6, 2026
F5 Networks confirmed that unidentified threat actors gained unauthorized access to its internal systems, resulting in the theft of files containing portions of BIG-IP source code and information about undisclosed vulnerabilities in the product. The breach was discovered on August 9, 2025, but evidence suggests that the attackers had maintained access to F5’s network for at least a year prior to detection. The attackers reportedly used a malware family known as BRICKSTORM, which has been attributed to a China-linked espionage group identified as UNC5221. This sophisticated intrusion highlights the ongoing targeting of edge infrastructure and security vendors by state-sponsored actors, who recognize the strategic value of such platforms in global networks. Following the breach, security researchers observed increased scanning activity targeting F5 BIG-IP devices on September 23, October 14, and October 15, 2025, although it remains unclear if these scans were directly related to the incident. Censys reported that over 680,000 F5 BIG-IP load balancers and application gateways are exposed on the public internet, with the largest concentrations in the United States, Germany, France, Japan, and China. Not all of these systems are necessarily vulnerable, but their public exposure increases the risk of exploitation. Security experts have emphasized the need for organizations to inventory, restrict access to, and proactively patch these devices to mitigate potential threats. The breach underscores the persistent risk posed by long-term, stealthy intrusions, particularly those orchestrated by nation-state actors. F5’s disclosure has prompted renewed calls for vigilance and improved security practices among organizations relying on edge devices. The incident also serves as a reminder that even companies specializing in security solutions are not immune to advanced persistent threats. Industry analysts have warned that the exposure of source code and vulnerability information could facilitate further attacks against F5 customers if not addressed promptly. Organizations using F5 products are advised to monitor for unusual activity, apply security updates, and review their network segmentation strategies. The breach has contributed to broader concerns about the security of network edge devices, which are increasingly targeted due to their critical role in enterprise infrastructure. F5’s response and ongoing investigation will be closely watched by the cybersecurity community as more details emerge about the scope and impact of the compromise.
Jun 29, 2026