F5 Was Breached by a Nation-State. They Stole the Source Code. Now They Are Exploiting a Bug F5 Told You Was Just a DoS. It Is Pre-Auth RCE. CISA Says Patch by Monday.

The Story

The timeline on this one matters. In October 2025, F5 published a security advisory disclosing that a "highly sophisticated nation-state threat actor" had gained access to its internal systems. The attacker had been inside F5's network for at least 12 months. During that time, they accessed BIG-IP source code and information about undisclosed vulnerabilities. Later reporting linked the attackers to China and identified the deployment of the Brickstorm backdoor on F5 customers' systems.

As part of that October disclosure, F5 patched CVE-2025-53521 in BIG-IP APM. At the time, it was classified as a denial-of-service vulnerability with a CVSS of 7.5. Many system administrators, already stretched thin, likely deprioritized it. A DoS bug on an internal component is not typically a hair-on-fire patch. watchTowr CEO Benjamin Harris put it plainly: "When F5 CVE-2025-53521 first emerged last year as a denial-of-service issue, it didn't immediately signal urgency, and many system administrators likely prioritized it accordingly."

That changed this week. F5 updated its advisory to reclassify CVE-2025-53521 as pre-authentication remote code execution, upgrading the CVSS score from 7.5 to 9.8 (v3.1) and 9.3 (v4.0). F5 confirmed that the vulnerability "has been exploited in the vulnerable BIG-IP versions." The flaw affects the apmd process, which processes live traffic. When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to RCE. BIG-IP systems in Appliance mode are also vulnerable.

CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog today, ordering Federal Civilian Executive Branch agencies to patch by Monday, March 30. Defused Cyber confirmed they are seeing "acute scanning activity" for vulnerable BIG-IP devices following the KEV addition.

The indicators of compromise published by F5 point to sophisticated post-exploitation. The threat actor is disabling the SELinux kernel security module, gaining control over the management interface, and deploying webshells that operate entirely in memory, leaving minimal forensic artifacts on disk. F5 also observed the attacker modifying sys-eicheck, the BIG-IP system integrity checker, to hide their modifications. In one observed case, the attacker modified components in one partition but failed to replicate the changes to the second partition. When the customer upgraded and rebooted into the clean partition, the modifications did not persist. But that is not a reliable defense. It is luck.

The most alarming post-exploitation capability is novel malware dubbed "Junction." Junction allows the adversary to route network traffic into and out of ESXi guest virtual machines via VSOCK sockets. An attacker can send HTTP requests to the ESXi host, and Junction routes the data to a guest VM of the attacker's choosing. This enables the threat actor to pivot from a compromised BIG-IP appliance to vCenter servers and ESXi hypervisors hosting virtualized infrastructure, a path that leads to complete environment compromise.

The Adversary Perspective

This is a textbook example of what happens when a nation-state breaches a network security vendor and weaponizes what they find.

The attacker had the source code. They did not need to reverse-engineer the patch. They had direct access to the BIG-IP codebase for over 12 months, along with information about vulnerabilities that F5 had not yet disclosed. This gave them a fundamental advantage: they could identify exploitable flaws faster, build more reliable exploits, and understand the internal architecture of the target device at a level that no external attacker could match. When CVE-2025-53521 was patched as a DoS, the attacker already knew it was more than that.

The initial classification as DoS was catastrophically wrong. Whether F5 genuinely believed the flaw was limited to DoS in October, or whether they underestimated it, the effect was the same: organizations deprioritized patching. A CVSS 7.5 DoS does not receive the same urgency as a CVSS 9.8 pre-auth RCE. The five-month gap between the original patch and the reclassification gave the attackers five months of exploitation against organizations that had rationally chosen not to prioritize a DoS patch. This is a systemic failure in how vulnerability severity is communicated.

The post-exploitation tradecraft is nation-state grade. In-memory webshells leave no files on disk. Modifying the device's own integrity checker means the appliance's built-in self-check will report that everything is clean. Disabling SELinux removes the kernel-level access controls. Junction malware traverses from network appliances to virtualization infrastructure via a protocol (VSOCK) that most network monitoring tools do not inspect. Every step is designed to evade detection at multiple layers simultaneously.

Defensive Takeaways