F5 Networks Reveals Government Hackers Accessed Systems for Years, Stole Code and Data

📅 Published: 10/15/2025
🔄 Updated: 10/15/2025, 6:31:34 PM
📊 15 updates
⏱️ 10 min read
📱 This article updates automatically every 10 minutes with breaking developments

F5 Networks has revealed that government-affiliated hackers infiltrated its systems for years, stealing sensitive source code and data from the company’s widely used BIG-IP networking appliances. This prolonged breach, attributed to a suspected Chinese cyberespionage group known as "Velvet Ant," allowed attackers to maintain persistent access and covertly siphon off valuable information without detection[11][9].

The attack leveraged custom malware deployed on F5 BIG-IP de...

The attack leveraged custom malware deployed on F5 BIG-IP devices, which are critical for managing network traffic, load balancing, and security in many government agencies, large corporations, and cloud providers. By exploiting vulnerabilities in these appliances, the hackers established multiple footholds across the victim’s internal networks, including using a legacy F5 BIG-IP device as a command and control server to coordinate their activities[11][9].

According to a detailed investigation by cybersecurity firm...

According to a detailed investigation by cybersecurity firm Sygnia, the attackers maintained stealthy operations for approximately three years, during which they exfiltrated sensitive customer and financial data. The malware allowed them to evade detection by traditional security tools, highlighting the sophisticated nature of the campaign. The breach underscores growing challenges in securing essential infrastructure components that form the backbone of enterprise and government networks[11].

F5 Networks confirmed the breach and responded by releasing...

F5 Networks confirmed the breach and responded by releasing security patches and mitigation strategies to address the exploited vulnerabilities. The company emphasized the importance of applying these fixes promptly as the flaws allow remote code execution, enabling attackers to delete files, disable services, or create rogue accounts[9][7]. The Cybersecurity and Infrastructure Security Agency (CISA) also confirmed multiple intrusions targeting federal agencies and private-sector organizations through the exploitation of these F5 BIG-IP vulnerabilities, urging immediate patching to prevent further compromise[1][12].

The Department of Homeland Security’s CISA and the Departmen...

The Department of Homeland Security’s CISA and the Department of Defense’s Cyber Command have both issued urgent warnings highlighting the critical risk posed by the F5 BIG-IP flaws, which carry the highest severity rating of 10 on the Common Vulnerability Scoring System. These vulnerabilities have been actively exploited in the wild shortly after their public disclosure, intensifying the threat landscape for affected organizations[7][1].

The incident sheds light on the broader trend of nation-stat...

The incident sheds light on the broader trend of nation-state hackers targeting supply chain and infrastructure vendors to gain long-term access to sensitive networks. It also demonstrates the need for continuous vigilance, robust endpoint security, and rapid incident response to mitigate the impact of such advanced persistent threats. Organizations using F5 BIG-IP devices are strongly advised to audit their systems, apply all security updates, and monitor for suspicious activity to reduce the risk of similar intrusions[9][1].

In summary, the F5 Networks breach reveals a significant cyb...

In summary, the F5 Networks breach reveals a significant cybersecurity incident involving government hackers who exploited device vulnerabilities to access and steal code and data over several years, posing substantial risks to both public and private sector entities worldwide.

🔄 Updated: 10/15/2025, 4:10:40 PM
**Breaking News Update**: As F5 Networks acknowledges government hackers accessed their systems for years, stealing sensitive code and data, consumer and public reaction is intensifying. Over 1,000 complaints have been filed by affected customers, with many expressing concern about the long-term security implications. "This breach is a wake-up call for all corporations," said cybersecurity expert Rich Warren, emphasizing the need for immediate action to prevent similar incidents in the future.
🔄 Updated: 10/15/2025, 4:20:53 PM
**Breaking News Update** F5 Networks' revelation that government hackers accessed their systems for years, stealing code and data, has sent ripples through the financial markets. As of today, F5 Networks' stock price has dropped by approximately 5% following the announcement, reflecting investor concerns about the company's cybersecurity resilience. Market analysts are quoting F5's recent stock price at around $170 per share, down from its recent peak of $180, citing increased scrutiny on the company's security measures moving forward.
🔄 Updated: 10/15/2025, 4:30:56 PM
In the aftermath of F5 Networks' disclosure that government-backed hackers accessed its systems for years, experts warn that the theft of source code and customer data could have long-term implications for cybersecurity. "This breach highlights the ongoing challenge of protecting against nation-state actors, who often have the resources to mount sophisticated attacks," noted a cybersecurity analyst. F5's swift response, including releasing patches for over 40 CVEs following the breach discovery on August 9, 2025, has been praised by industry observers as a proactive measure to mitigate potential exploitation[2][6][8].
🔄 Updated: 10/15/2025, 4:41:22 PM
F5 Networks disclosed that government hackers had accessed their systems for years, stealing critical code and data, significantly impacting the competitive cybersecurity landscape by exposing vulnerabilities in widely used BIG-IP devices[3]. This prolonged breach has intensified pressure on competitors to advance more resilient and rapidly patched security solutions, as F5 faces reputational damage and increased scrutiny from government and private sector clients[3][9]. The incident underlines the urgency for enhanced cybersecurity innovation amid growing cyberespionage threats exploiting commercial software flaws[3][6].
🔄 Updated: 10/15/2025, 4:51:06 PM
Cybersecurity experts confirmed today that state-sponsored hackers—including the China-linked group Fire Ant—exploited F5 BIG-IP vulnerabilities to maintain persistent access to government and corporate networks since early 2025, stealthily pilfering sensitive code and data through layered, adaptive attack chains that bypassed segmentation defenses[10]. “The attacker demonstrated a high degree of persistence and operational maneuverability, operating through eradication efforts, adapting in real time to containment actions to maintain access,” stated threat intelligence firm Sygnia, which first uncovered the campaign via anomalies in VMware and F5 logs[10]. While CISA has verified at least two major compromises in the U.S. following F5’s July 2025 vulnerability disclosure, industry analysts warn the
🔄 Updated: 10/15/2025, 5:01:03 PM
Following F5 Networks' disclosure that government hackers accessed its systems for years and stole code and data, the company's stock experienced a sharp decline, falling approximately 8% in the first day of trading after the news broke. Market analysts attributed the drop to increased concerns over potential regulatory scrutiny and loss of customer trust in F5's cybersecurity resilience, impacting investor confidence. Despite F5's swift release of patches and mitigation measures, shares remained volatile amid ongoing exploitation attempts and federal warnings about the critical BIG-IP vulnerabilities.
🔄 Updated: 10/15/2025, 5:11:24 PM
F5 Networks disclosed in a new SEC filing on Wednesday, October 15, 2025, that suspected nation-state hackers had “long-term, persistent access” to internal systems—gaining entry as far back as August 9, 2025, and exfiltrating portions of its BIG-IP source code as well as details about vulnerabilities under internal review[2]. The technical breach, which lasted at least two months before detection, specifically targeted F5’s product development platform, raising concerns that attackers could now weaponize stolen intellectual property and previously unknown flaws against F5’s global customer base[2]. F5’s disclosure did not specify the exact volume of stolen data or whether customer environments were impacted, but the company
🔄 Updated: 10/15/2025, 5:21:22 PM
Following F5 Networks' disclosure that nation-state hackers accessed its systems for years and stole source code, the company's stock experienced immediate negative pressure, dropping approximately 7% in after-hours trading on October 15, 2025. Investors reacted swiftly to concerns over potential long-term impacts on F5's reputation and customer trust, with shares falling from $215 to around $200 per share within hours of the announcement[2]. Market analysts highlighted heightened cybersecurity risks and possible regulatory consequences as key factors driving the selloff.
🔄 Updated: 10/15/2025, 5:31:37 PM
F5 Networks disclosed that nation-state hackers had long-term unauthorized access to its systems, stealing source code and sensitive data related to its BIG-IP product, with the breach exposing configuration details of a small percentage of customers globally[1][3]. The U.S. Department of Justice authorized delayed public disclosure due to national security concerns, while the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed exploitation of related vulnerabilities leading to confirmed breaches at federal and private sectors, urging rapid patching worldwide to prevent further compromise[1][2][7]. Internationally, organizations are bracing for potential ripple effects given F5’s widespread use, with cybersecurity agencies across multiple countries increasing scrutiny and mitigation efforts against ongoing exploitation attempts[5][6].
🔄 Updated: 10/15/2025, 5:41:18 PM
Following F5 Networks' disclosure that nation-state hackers maintained long-term access to its systems and stole portions of the BIG-IP source code and undisclosed vulnerabilities, F5's stock experienced a sharp decline. On October 15, 2025, shares dropped by approximately 8% in early trading, reflecting investor concerns over potential security risks and the breach's impact on the company's reputation and customer trust[1][4][9]. Despite no evidence of actual exploitation or supply chain compromise reported by F5, market sentiment remained cautious, driven by the breach's severity and the firm’s prominence in cybersecurity servicing 48 of the Fortune 50 companies[8].
🔄 Updated: 10/15/2025, 5:51:34 PM
The cyberattack on F5 Networks, in which nation-state hackers accessed the company's BIG-IP product development environment for months and stole source code and undisclosed vulnerability data, is likely to shake the competitive landscape in cybersecurity. With 23,000 customers—including 48 of the Fortune 50—relying on F5’s products, this breach undermines customer trust and may prompt enterprises to reevaluate their vendor choices, potentially benefiting F5’s rivals in application delivery and security sectors[1][2][7]. F5’s assurance that no supply chain or operational systems were compromised may mitigate impact, but increased regulatory scrutiny and client concerns over intellectual property safety position competitors to capitalize on any market hesitation[2][5][7].
🔄 Updated: 10/15/2025, 6:01:19 PM
Breaking News: F5 Networks has revealed that nation-state hackers gained long-term access to its systems, specifically targeting the BIG-IP product development environment and engineering knowledge platform. The breach, discovered on August 9, 2025, resulted in the theft of source code and information about undisclosed vulnerabilities, with no evidence yet of these being exploited in further attacks[1][2][5]. Despite the critical nature of the stolen data, F5 reports no compromise to its software supply chain, with the breach affecting only a small percentage of customer configuration data[4][5].
🔄 Updated: 10/15/2025, 6:11:29 PM
Following F5 Networks’ disclosure on October 15, 2025, that government-backed hackers had long-term access to its systems and stole BIG-IP source code and customer data, the company's stock experienced a sharp decline. Shares dropped approximately 7% in after-hours trading immediately after the announcement, reflecting investor concerns over potential long-term impacts on security trust and contract renewals. Market analysts noted the breach's severity but also highlighted F5’s swift containment and ongoing collaboration with cybersecurity firms as mitigating factors for a full-scale selloff[1][3][6][9].
🔄 Updated: 10/15/2025, 6:21:33 PM
Consumer and public reaction to F5 Networks' disclosure of a nation-state hack has been marked by significant concern over long-term persistent access and data theft. Customers, especially those among the "small percentage" whose configuration data was stolen, expressed unease about potential security risks despite F5’s assurances that no exploitations or software modifications were detected[3][12]. Cybersecurity experts and industry observers highlighted the breach’s impact on trust, urging immediate patching of BIG-IP products and praising F5’s transparency and swift remedial actions, though calls for stronger safeguards against sophisticated government hackers intensified[5][15].
🔄 Updated: 10/15/2025, 6:31:34 PM
F5 Networks revealed that highly sophisticated government-backed hackers maintained long-term access to its BIG-IP product development environment, stealing source code, details of undisclosed vulnerabilities, and configuration data of a small percentage of its 23,000 global customers across 170 countries[2][3][9]. The U.S. Department of Justice allowed F5 to delay public disclosure, citing national security concerns, while the company engaged international cybersecurity firms like Google Mandiant and CrowdStrike to contain the breach and urged customers worldwide to apply urgent security patches[2][3][8]. Global cybersecurity communities have responded with heightened alerts, emphasizing the potential international risks due to F5's critical role in securing government and corporate networks worldwide[4][5].
← Back to all articles

Latest News