Critical F5 BIG-IP CVE-2023-46747 lets attackers gain SSH access

Key Takeaways

• A sophisticated multi-stage attack leveraged an F5 BIG-IP edge appliance as the initial point of entry, escalating to Active Directory compromise.
• The compromised BIG-IP device was running an end-of-life version, highlighting risks associated with unpatched and unsupported infrastructure.
• Attackers exploited an internal, unpatched Atlassian Confluence server for remote code execution after gaining an initial foothold.
• The intrusion underscores a growing trend where perimeter devices are targeted as initial access vectors, leading to identity-focused campaigns.

Recent analysis by Microsoft’s Defender Security Research details a multi-stage intrusion that began with the exploitation of an internet-facing F5 BIG-IP edge appliance. This initial breach served as a gateway for a broader, identity-focused attack that ultimately achieved access to Active Directory within the targeted environment.

Microsoft researchers indicate that this incident exemplifies an emerging trend where devices traditionally viewed as security boundaries—such as firewalls, VPN gateways, and load balancers—are being repurposed by threat actors as initial access points. Because these edge appliances are often exposed to the internet, may receive less stringent monitoring, and are typically trusted within enterprise networks, their compromise can provide attackers with a persistent, low-visibility foothold, along with access to stored credentials, certificates, and identity integrations.

Initial Access Through an End-of-Life F5 BIG-IP

The attack commenced with threat actors establishing SSH access to an internal Linux host. This access originated from a network device identified as an F5 BIG-IP load balancer. Investigation revealed the source to be an Azure-hosted BIG-IP Virtual Edition appliance running version 15.1.201000. This particular build, frequently deployed via Azure ARM templates and Terraform modules, reached its end-of-life on December 31, 2024.

Upon gaining SSH access to the Linux server, the attacker authenticated using a privileged account. They maintained hands-on keyboard control throughout the operation without deploying explicit persistence mechanisms. This highlights the significant risks posed by over-privileged identities, especially those with sudo rights.

Once inside the host, the attacker initiated aggressive reconnaissance. They used a shell script to execute horizontal Nmap scans across internal subnets, identifying live hosts. This was followed by more focused vertical scans to pinpoint open services. The open-source tool gowitness was then deployed via a SOCKS5 proxy to capture screenshots and fingerprint exposed HTTP/HTTPS services.

When Windows servers were discovered, the threat actor attempted NTLM-based lateral movement using a suite of familiar open-source tools, including enum4linux, netexec, smbclient, rpcclient, timeroast, ldapsearch, kerbrute, and responder. These initial attempts at lateral movement were unsuccessful.

The attacker subsequently downloaded a custom scanning tool from the command-and-control (C2) server 206.189.27[.]39 using wget. Microsoft flagged this tool as HackTool:Linux/MalPack.B. This custom scanner was used to probe the organization’s web applications and mobile services, including Firebase and GCM, with the goal of enumerating access controls.

During reconnaissance, an internal Atlassian Confluence server with unpatched vulnerabilities was identified. Despite not being internet-facing, the Confluence server became accessible once the attacker had established an internal foothold. The attacker then exploited these unpatched vulnerabilities to achieve remote code execution.

Repeated attempts to deploy payloads were blocked by real-time protection. Assuming network-level blocking, the attacker pivoted by setting up an anonymous FTP server on the Linux staging host using Python’s ftplib. They then transferred the custom tool into /dev/shm via curl.

Following the compromise of Confluence, the attacker extracted credentials from configuration files, specifically server.xml and confluence.cfg.xml. These harvested credentials were then leveraged against the Windows infrastructure, escalating the attack.

This escalation involved Kerberos relay attacks and the exploitation of CVE-2025-33073. The attacker used netexec in conjunction with PetitPotam coercion and DNS manipulation tools to target a domain controller.

Microsoft’s analysis of the intrusion highlights how a single remote code execution (RCE) vulnerability in a perimeter-adjacent web component can trigger a cascade, leading to identity compromise in a completely separate application, traversing platform and trust boundaries. The report emphasizes that attackers do not necessarily need to be highly sophisticated, but rather persistent, especially where patching and monitoring gaps exist across hybrid environments. Microsoft Defender for Endpoint successfully detected the malicious activity, blocking the ELF payload on the specific Confluence host where real-time protection was enabled.

Indicators of Compromise (IOCs)

What You Should Do

• Treat all internet-facing edge appliances, including F5 BIG-IP devices, as Tier-0 assets. Implement strict lifecycle management, ensuring they are always patched to the latest versions and not running end-of-life software.
• Harden internal web applications with the same urgency and rigor applied to external services. Regularly scan for and patch vulnerabilities, even for systems not directly exposed to the internet.
• Implement robust identity hardening measures. Disable NTLM where possible, enforce SMB and LDAP signing, and enable Extended Protection for Authentication to mitigate relay-style attacks.
• Enhance monitoring for SSH logons originating from edge devices like F5 BIG-IP and credential access attempts from processes associated with internal applications such as Confluence. Utilize advanced hunting queries provided by security vendors to detect suspicious activity.
• Review and audit privileged accounts, ensuring that the principle of least privilege is strictly enforced to limit the impact of a compromised credential.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.