Threat Brief: Nation-State Actor Steals F5 Source Code and Undisclosed Vulnerabilities
Summary: On Oct. 15, 2025, F5 disclosed that a nation-state threat actor conducted a long-term compromise of its corporate networks, stealing source code from its BIG-IP suite and information about undisclosed vulnerabilities. F5's investigation found the attackers held access to its product development environment and engineering knowledge management platform, and some exfiltrated files from the knowledge management platform contained configuration or implementation information for a small percentage of customers.
What you should know: The actor took not just source code but details of vulnerabilities F5 was actively patching, which can shorten the path to exploits for flaws with no public patch - and with the compromise identified in early August 2025, those vulnerabilities could have been exposed for upwards of two months before disclosure.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2022-1388CVE-2023-46747
- Related
- CVE-2023-46747: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Oct 31, 2023CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability Known Exploited Vulnerabilities · May 10, 2022Threat Advisory: Critical F5 BIG-IP Vulnerability Cyber Risks ·