Hackers use F5 BIG-IP malware to stealthily steal data for years

Sygnia observed a suspected Chinese APT, 'Velvet Ant', compromise exposed legacy F5 BIG-IP appliances via known RCE vulnerabilities to install custom implants (PMCD, MCDP, SAMRID, ESRDE) and use those devices to deploy PlugX to internal servers, maintain long-term persistence, and exfiltrate sensitive customer and financial data for roughly three years; recommended mitigations include patching, removing internet-exposed management interfaces, network segmentation, outbound connection restrictions, and replacing legacy devices.