⚡ Weekly Recap: F5 Breached, Linux Rootkits, Pixnapping Attack, Ether Hiding & More

Summary: F5 disclosed that unidentified threat actors broke into its systems and stole files containing some of BIG-IP's source code and information on undisclosed vulnerabilities, learning of the incident on August 9, 2025, though attackers are believed to have been in its network for at least 12 months. The attackers used a malware family called BRICKSTORM, attributed to a China-nexus espionage group dubbed UNC5221, while Censys identified over 680,000 F5 BIG-IP load balancers and application gateways visible on the public internet.
Why it matters: Attackers sat inside a security vendor's network for at least 12 months and walked out with BIG-IP source code and details of undisclosed vulnerabilities, while more than 680,000 of its load balancers and gateways remain publicly visible on the internet.

Read the original at The Hacker News ↗