US Scrambles to Patch F5 Amid China-Linked Breach

Federal officials are scrambling to contain nation-state hackers exploiting stolen source code from networking devices and software maker F5 amid staffing pressures created by the ongoing government shutdown.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

F5 confirmed in a Friday update the nation-state attacker had maintained long-term access to its internal development and engineering systems – ultimately stealing source code and internal vulnerability research tied to the company’s flagship BIG-IP products. The company said it first detected the intrusion in August and has since launched extensive containment efforts, which it said appeared to have prevented further unauthorized activity.

U.S. officials linked the hacking to a nation-state and warned it poses an “imminent risk” to federal networks – just as a prolonged government shutdown has sidelined 65% of the Cybersecurity and Infrastructure Security Agency’s workforce (see: CISA in Disarray Amid Shutdown and Growing Political Threats).

“The sheer volume of devices that must now be patched across the federal ecosystem requires way more hands on deck than we currently have available,” a former senior federal cybersecurity official who requested anonymity to discuss the hacking campaign. “This is the exact sort of chaos people warn about when discussing the need to keep the government open.”

Stolen files reportedly include information about undisclosed vulnerabilities F5 had been researching, though the company emphasized there is no current evidence those flaws are being actively exploited or that any critical remote code execution bugs were exposed.

New research shows the scale of exposure could be greater than initially feared, with more than 680,000 F5 BIG‑IP devices visible online, according to a Thursday advisory from the cybersecurity firm Censys – with many of those tied to U.S. government and critical infrastructure networks. Analysts now attribute the F5 hack to a Chinese state-backed group tracked by Mandiant as UNC5221. The group’s yearlong infiltration of F5’s internal systems mirror the tactics of China’s most aggressive hacking operations.

Some of the stolen data may also include limited configuration details from a small subset of customers, according to the update, and the company says it is reaching out directly to those affected.

CISA issued an emergency directive requiring agencies to secure or disconnect affected devices by Oct. 22 – a deadline that underscores just how quickly threat actors can move when armed with source code and vulnerability intelligence, said John Fokker, vice president of threat intelligence at Trellix.

“In normal times, that’s a sprint,” Fokker told ISMG. “Under shutdown constraints and furlough pressure, patching cadence, validation and monitoring is an even bigger task.”

F5 has released software updates across its product ecosystem – including BIG-IP, F5OS, BIG-IQ and Kubernetes offerings – and is advising customers to install the patches immediately.

F5 says it has strengthened monitoring and security controls across its software development infrastructure and is continuing code reviews and penetration testing to root out any lingering risks. CISA, which did not immediately respond to requests Friday, previously told reporters it is managing the incident with the limited staff still in place during the shutdown.

“While a government shutdown can disrupt federal operations, we’re sustaining essential functions,” CISA Executive Assistant Director for Cybersecurity Nick Andersen said Wednesday.

Experts say the federal response must go beyond short-term patching and incorporate a layered strategy that spans immediate risk reduction, targeted diplomacy and long-term law enforcement investigations.

“This kind of breach exposes a technical gap – but more importantly, a major point of operational fragility across the supply chain,” said one former defense official. “We need to stop reacting and start designing around that reality.”