Back Blogs.Microsoft

From edge appliance to enterprise compromise: Multi

Blogs.Microsoft •Microsoft Defender Security Research Team • May 22, 2026

A multi-stage attack on Linux devices began with an exposed F5 BIG-IP edge appliance and pivoted to an internal Confluence server for credential theft and identity compromise. Learn how the threat actor attempted Kerberos relay and lateral movement, and how Microsoft Defender detected, blocked, and unraveled the attack.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

F5 BIG-IP Exploited in Multi-Stage Cyber Intrusion Attack A multi-stage cyber intrusion attack exploited an exposed F5 BIG-IP edge appliance, leading to identity-focused attacks that accessed Active Directory and involved credential theft from an internal Confluence server. Microsoft Defender Security Research reported that the attack utilized techniques such as Kerberos relay and lateral movement. The incident highlights a trend where traditional security devices are targeted as entry points for broader attacks. Organizations using F5 BIG-IP appliances are particularly affected, with potential risks to their internal networks. The attack underscores the importance of securing edge devices and monitoring for unusual activity. Current mitigation efforts are underway, with Microsoft Defender actively blocking and analyzing the attack vectors used. 3 sources 68

Extracted Entities

Platforms (3)

Confluence F5 Big-ip Linux