F5 Hack Exposes Fed Networks to Full Compromise

A nation-state cyberthreat actor is posing an “imminent risk” to federal networks during the government shutdown, a U.S. cyber defense agency warned Wednesday, targeting vulnerable devices across agencies as key operations remain stalled.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The Cybersecurity and Infrastructure Security Agency on Wednesday issued its third emergency directive this year, warning that a nation-state actor breached F5’s internal systems and stole sensitive files – including parts of its BIG-IP source code and undisclosed vulnerability details that could be used to build custom exploits. The threat actor is “targeting federal networks” and scanning for vulnerable devices that could result in a “full compromise of those targeted information systems,” according to CISA Executive Assistant Director for Cybersecurity Nick Andersen.

“While a government shutdown can disrupt federal operations, we’re sustaining essential functions,” Andersen told reporters when asked whether CISA and other agencies have enough staff to carry out the emergency actions outlined in the directive. He said the latest round of reductions in force issued Friday did not affect personnel working on the directive, which requires agencies to apply newly released vendor updates across multiple F5 products.

Andersen added that there is currently no evidence federal networks have been breached using the exploit. The company also said in a filing with the U.S. Securities and Exchange Commission on Wednesday that it “believes its containment actions have been successful.”

The emergency directive comes as CISA is facing significant operational strain, with only about 35% of staff remaining on the job amid the government shutdown and internal reassignments that have pulled cybersecurity personnel into non-cyber missions across the Department of Homeland Security. Current and former officials describe the agency’s capacity to respond to critical threats as dangerously thin, with key programs paused, senior talent departing and uncertainty mounting over who is responsible for maintaining mission continuity across vital cyber initiatives (see: CISA in Disarray Amid Shutdown and Growing Political Threats).

While U.S. officials and F5 have not directly implicated any single nation-state, security analysts believe the hackers are a highly-advanced, government-backed unit from China aiming to gain long-term and persistent access to sensitive systems. The application security and multi-cloud management firm maintains more than 1,000 corporate customers and provides services for over 85% of all Fortune 500 companies.

The U.K.’s National Cyber Security Centre also warned Wednesday that the F5 vulnerability could enable threat actors to exploit the firm’s devices and software while conducting static and dynamic analysis for identification of logical flaws and vulnerabilities. A successful breach could allow hackers to “move laterally within an organization’s network, exfiltrate data and establish persistent system access,” the centre said.

The company said it first detected unauthorized activity in its internal systems in August and immediately launched an investigation with help from outside cybersecurity experts. F5 determined that a nation-state actor had accessed and exfiltrated certain corporate records, including proprietary source code and vulnerability information, though it did not specify which products were affected at the time.

According to a regulatory filing, the attackers also accessed customer and employee information stored in internal file shares and email inboxes, which caused F5 to notify law enforcement and impacted clients. CISA officials told reporters the stolen vulnerability data likely enabled the actor to craft highly tailored exploits aimed at breaching unpatched federal systems.

Agencies are required to identify all F5 BIG-IP hardware and software products deployed across their systems, determine whether public-facing management interfaces are exposed to the internet and apply vendor patches by Oct. 22. Any outdated or end-of-support devices must be disconnected or fully decommissioned, and additional patching and hardening steps are due by Oct. 31.

CISA is also directing agencies to report both initial findings and a full product inventory by Oct. 29 and Dec. 3, respectively. The agency said that any delayed mitigation could leave systems open to persistent compromise.