Hackers Exploit F5 BIG-IP Appliance to Gain SSH Access and Pivot Into Enterprise Linux Networks

Microsoft reported a multi-stage intrusion that began with SSH access via an end-of-life F5 BIG-IP VE, followed by internal reconnaissance, exploitation of an unpatched Atlassian Confluence RCE, credential harvesting, and Kerberos/NTLM relay attacks against Active Directory; observed IOCs include C2 206.189.27.39 and multiple file hashes, and the vendor urges urgent patching, identity hardening, and edge-appliance lifecycle management.