Hackers Exploit F5 BIG

Cybersecuritynews •Guru Baran • May 23, 2026

A multi-stage intrusion attack where a threat actor exploited an internet-facing F5 BIG-IP edge appliance as the entry point for a widespread, identity-focused attack that ultimately accessed Active Directory. According to Microsoft’s Defender Security Research, the attack reflects a growing trend in which firewalls, VPN gateways, and load balancer devices traditionally deployed as security boundaries […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

F5 BIG-IP Exploited in Multi-Stage Cyber Intrusion Attack A multi-stage cyber intrusion attack exploited an exposed F5 BIG-IP edge appliance, leading to identity-focused attacks that accessed Active Directory and involved credential theft from an internal Confluence server. Microsoft Defender Security Research reported that the attack utilized techniques such as Kerberos relay and lateral movement. The incident highlights a trend where traditional security devices are targeted as entry points for broader attacks. Organizations using F5 BIG-IP appliances are particularly affected, with potential risks to their internal networks. The attack underscores the importance of securing edge devices and monitoring for unusual activity. Current mitigation efforts are underway, with Microsoft Defender actively blocking and analyzing the attack vectors used. 3 sources 68

Hackers Exploit F5 BIG

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (2)