Edge-to-Core Escalation: Nation-State Actors Weaponize EOL F5 BIG-IP Appliances

Nation-state threat actors are pivoting from traditional endpoint attacks to "Edge-to-Core" escalation, weaponizing unpatched or End-of-Life (EOL) F5 BIG-IP appliances to bypass perimeter defenses. By exploiting the implicit trust between edge devices and internal infrastructure, attackers are successfully pivoting through internal SaaS applications to achieve full Identity and Active Directory compromise.

• Introduction: The Strategic Shift to Edge-to-Core Escalation

  • Departure from Traditional Vectors: Adversaries are moving away from phishing and endpoint-centric intrusions in favor of targeting the "Edge"—the boundary where external traffic meets internal trust zones.
  • Weaponizing Infrastructure Blind Spots: The focus has shifted toward EOL or legacy network appliances that often lack modern EDR coverage, providing a low-visibility environment for long-term persistence.
  • The Trust Paradigm: Attackers leverage the implicit architectural trust granted to edge appliances (like load balancers) to move seamlessly into the internal Linux environment without triggering traditional perimeter alarms.
  • Multi-Domain Traversal: This campaign represents a sophisticated transition from network-centric exploitation to identity-centric maneuvers, traversing Linux, SaaS, and Windows/AD environments in a single chain.

• The Mechanics of the Breach: F5 BIG-IP Exploitation

  • Initial Entry via CVE-2025-53521: Attackers target vulnerabilities within the F5 BIG-IP Access Policy Manager (APM), utilizing CVE-2025-53521 to gain unauthorized access to the management plane.
  • SSH Hijacking and Linux Footholds: Once the APM is compromised, actors utilize the appliance's privileged position to establish SSH sessions into internal Linux hosts, effectively leaping over the firewall.
  • The EOL Vulnerability Gap: A critical driver of this campaign is the persistence of End-of-Life (EOL) hardware that no longer receives security updates, leaving them permanently vulnerable to known exploits.
  • Persistence Establishment: Initial access is solidified through the deployment of custom Linux-based malware and scripts, ensuring that the foothold survives appliance reboots or session timeouts.

• Internal Reconnaissance and Host Persistence

  • Automated Surface Mapping: Attackers deploy a suite of discovery tools, including Nmap and gowitness, to visually and programmatically map the internal network and identify hidden web services.
  • Deployment of MalPack.B: The use of "HackTool:Linux/MalPack.B" provides a modular framework for executing further payloads and maintaining a stealthy presence within the internal Linux ecosystem.
  • Network Discovery Tooling: Actors utilize enum4linux and netexec to enumerate SMB shares and identify high-value targets within the internal Windows environment from their Linux pivot point.
  • Stealth Operations: By operating from the edge appliance and internal Linux servers, attackers avoid the scrutiny of Windows-centric security monitoring tools, significantly increasing their dwell time.

• Lateral Movement: The Pivot Through Atlassian Confluence

  • Targeting Internal Web Applications: Having mapped the network, actors target non-exposed, internal-only applications—specifically Atlassian Confluence—which are often less rigorously patched than external ones.
  • Remote Code Execution (RCE): Attackers leverage unpatched RCE vulnerabilities in Confluence to gain a foothold on the application server, moving deeper into the enterprise core.
  • Credential Harvesting: Once inside the Confluence environment, actors target configuration files, specifically server.xml and confluence.cfg.xml, to extract plaintext or encrypted database and service credentials.
  • Leveraging Application Trust: The pivot through a trusted internal collaboration tool allows attackers to move from a general Linux foothold to a position where they can interact with identity management systems.

• Identity Compromise: Path to Domain Dominance

  • Transition to Windows/AD: Armed with credentials from internal applications, attackers shift their focus toward the heart of the enterprise: the Active Directory (AD) environment.
  • NTLM and Kerberos Relay: Actors deploy sophisticated relay attacks, including the use of PetitPotam and the exploitation of CVE-2025-33073, to coerce authentication from high-privileged accounts.
  • Identity Coercion: By forcing Domain Controllers or other privileged servers to authenticate back to an attacker-controlled listener, the actors capture and relay hashes to escalate privileges.
  • Full Domain Takeover: The final stage involves the compromise of the Domain Controller, granting the nation-state actor total control over the enterprise identity fabric and all associated resources.

• Technical Artifacts and Indicators of Compromise (IoCs)

  • Command and Control (C2) Infrastructure:
    • 206.189.27.39 — Primary C2 server used for orchestration and data exfiltration.
  • Malicious File Hashes (Tooling):
    • 4a927d031919fd6bd88d3c8a917214b54bca00f8ddc80ecfe4d230663dda7465 — Custom scanning utility.
    • b4592cea69699b2c0737d4e19cff7dca17b5baf5a238cd6da950a37e9986f216 — Nmap automation script.
    • 710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122a — Kerbrute tool for user enumeration.
    • 57b3188e24782c27fdf72493ce599537efd3187d03b80f8afe733c72d68c5517 — gowitness screenshot scanner.
    • bdd5da81ac34d9faa2a5118d4ed8f492239734be02146cd24a0e34270a48a455 — Python-based NTLM relay script.
  • Tooling Suite: Heavy reliance on netexec, enum4linux, and custom scripts for automated lateral movement and credential theft.

• Business Impact and Risk Assessment

  • Criticality Level: Critical — The attack chain results in the complete compromise of the enterprise identity layer, rendering all internal security boundaries obsolete.
  • Perimeter Failure: Demonstrates that traditional perimeter security is ineffective when the "trusted" edge devices themselves are the primary attack vector.
  • Dwell Time Risks: The lack of consistent EDR/XDR monitoring on F5 appliances and internal Linux servers allows actors to operate for extended periods without detection.
  • Credential Exposure: Highlights the severe risk of storing sensitive service credentials in application configuration files (e.g., Confluence), which act as keys to the kingdom once a pivot is achieved.

• Mitigation and Defensive Strategy

  • Edge Asset Reclassification: Treat all edge appliances (Load Balancers, VPNs, Firewalls) as Tier-0 assets; enforce strict lifecycle management and immediate decommissioning of EOL hardware.
  • Internal Application Hardening: Apply the same patching urgency to internal-only web applications (e.g., Confluence, Jira) as is applied to internet-facing services.
  • Identity-Centric Defenses: Implement mandatory SMB signing, LDAP channel binding, and Extended Protection for Authentication (EPA) to neutralize NTLM/Kerberos relay attacks.
  • Omni-Platform Visibility: Deploy and monitor XDR/EDR solutions across all environments, ensuring that Linux hosts and edge management planes are not excluded from the security telemetry stream.