The Files Look Clean. The F5 Appliance Could Still Be Backdoored.
Sophos found a rootkit that makes Apache execute a malicious version of legitimate BIG-IP APM files while the copies on disk remain clean.
Web Shell
The Firewall Manager Shipped With a Password Attackers Already Knew.
Cisco has documented three distinct FMC attack campaigns, including no-login root access, Sandworm-linked tooling and ransomware preparation. Patch exposed managers and investigate each cluster separately.