• US agencies ordered to patch F5 products after major breach.
• Officials say the breach is “imminent threat” linked to China-backed hackers.

US officials have warned that hackers backed by a foreign government are targeting federal networks by exploiting flaws in products made by the cybersecurity company F5.

The Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive on October 15, saying attackers had broken into F5’s systems, stolen parts of its source code, and accessed details about product vulnerabilities. Officials said the information could be used to breach F5 software and potentially gain full access to government networks.

“The cyber threat actor presents an imminent threat to federal networks,” CISA said.

Nick Andersen, CISA’s Executive Assistant Director for Cybersecurity, said federal agencies had been ordered to identify and patch F5 devices immediately. He also urged private organisations to do the same, warning that “the risk of this vulnerability extends to every organisation and sector that’s using this product.”

Andersen declined to say who was behind the attack but noted that, so far, there was no evidence that any US civilian agency had been compromised.

The breach inside F5

F5 said it detected unauthorised access to some of its systems on August 9 and took “extensive actions” to contain the intrusion. The company hired outside experts, including CrowdStrike, Mandiant, NCC Group, and IOActive, to investigate the breach.

In a filing with the US Securities and Exchange Commission, F5 said there was no sign that its software development process had been tampered with. However, information from a small number of customers was affected, and the company has reached out to those impacted.

F5 also said the US Department of Justice had allowed it to delay public disclosure of the breach until September 12, citing national security concerns. British authorities later issued a similar alert, urging F5 users to install updates immediately.

China-linked hackers blamed

According to Bloomberg, people familiar with the investigation said the F5 breach has been linked to hackers backed by China. They reportedly maintained long-term access to parts of F5’s network, stealing source code from its BIG-IP suite – software widely used by Fortune 500 companies and government agencies.

Sources said the hackers remained in F5’s systems for at least a year. CEO François Locoh-Donou has been briefing customers directly on the findings and the group’s alleged ties to China, though F5 has not publicly confirmed those details.

China’s Foreign Ministry and its embassy in Washington did not respond to requests for comment.

What the hackers targeted

F5’s BIG-IP products play a central role in managing how large organisations handle online traffic. They distribute workloads, manage access controls, and help secure applications through firewalls and authentication tools.

Cybersecurity experts warn that access to BIG-IP source code could allow hackers to insert backdoors, intercept traffic, or access sensitive data without detection.

F5 also sent customers a guide to help identify a type of malware known as Brickstorm, linked to a Chinese state-backed hacking group. According to Google-owned Mandiant, this group – known as UNC5221 – has been stealing source code from major tech companies since 2023 to find exploitable bugs in their products.

Government response

CISA described the F5 breach as a “significant cyber threat” and ordered all federal agencies to update F5 devices by October 22. Acting Director Madhu Gottumukkala said the vulnerabilities could be exploited easily and warned that failure to act could lead to a “catastrophic compromise of important information systems.”

“The same risks extend to any organisation using this technology,” she said, warning that a failure to act could lead to “a catastrophic compromise of important information systems.”

The UK’s National Cyber Security Centre also issued an alert about the F5 breach, warning that hackers might use their access to find more vulnerabilities. The UK government urged all F5 users to identify affected systems, report potential breaches, and install the latest security patches.

Want to experience the full spectrum of enterprise technology innovation? Join TechEx in Amsterdam, California, and London. Covering AI, Big Data, Cyber Security, IoT, Digital Transformation, Intelligent Automation, Edge Computing, and Data Centres, TechEx brings together global leaders to share real-world use cases and in-depth insights. Click here for more information.

TechHQ is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.