Nation-state actor steals F5 source code and undisclosed vulnerabilities

On Oct. 15, 2025, F5 — a U.S. technology company — disclosed that a nation-state threat actor conducted a significant long-term compromise of their corporate networks. In this incident, attackers stole source code from their BIG-IP suite of products and information about undisclosed vulnerabilities. F5’s BIG-IP suite is commonly used by large organizations, primarily in the U.S. but also globally, for availability, access control and security. Organizations including government agencies and Fortune 500 companies rely on BIG-IP.

Cortex Xpanse currently identifies over 600,000 F5 Big-IP instances exposed to the internet.

F5’s investigation revealed that the attackers maintained long-term access to the company’s product development environment and engineering knowledge management platform. This enabled attackers to access highly sensitive data.

Read more at Unit 42