F5: Nation-state actors gained long-term access to BIG-IP, stole code

Seattle-based application delivery and security vendor F5 disclosed on Wednesday that unidentified, highly sophisticated nation state actors maintained longterm access to parts of its network, exfiltrating files that included segments of BIG-IP source code and information about undisclosed vulnerabilities. The company said it first detected the unauthorized access on August 9 and provided the U.S. Department of Justice with notice that allowed a delayed public disclosure under SEC rules while law enforcement investigations continued.

According to a Form 8-K filed with the Securities and Exchange Commission, the intruders had persistent access to systems tied to the BIG-IP product development environment and an engineering knowledge management platform. Some of the stolen files contained portions of BIG-IP source code and details of vulnerabilities F5 was actively addressing, as well as configuration and implementation information pertaining to a small percentage of customers. F5 said investigators found no evidence the attackers modified its software supply chain, including source code or build and release pipelines, and no evidence the threat actor accessed or altered the...