# CVE-2025-53521: F5 BIG-IP APM Unauthenticated Remote Code Execution via apmd Process — Active Exploitation by UNC5221 (BRICKSTORM)

> Critical unauthenticated remote code execution vulnerability in F5 BIG-IP Access Policy Manager (APM) apmd process (CVE-2025-53521, CVSS 9.8). Originally disclosed as DoS in October 2025, reclassified as RCE in March 2026 after discovery of active exploitation by China-nexus threat actor UNC5221, who had breached F5 networks for 12+ months and deployed the BRICKSTORM backdoor on customer systems. CISA KEV listed March 27, 2026 with remediation deadline March 30, 2026.

- **Published:** 2026-03-30T12:00:00Z
- **Last reviewed:** 2026-03-30T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0297
- **ID:** TL-2026-0297
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UNC5221 (China)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-53521

## Description

CVE-2025-53521 is a critical unauthenticated remote code execution vulnerability in F5 BIG-IP Access Policy Manager (APM) affecting the apmd process, which handles live traffic processing. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and allows remote attackers to achieve code execution by sending specially crafted traffic to a virtual server with a BIG-IP APM access policy configured.

The vulnerability was initially published on October 15, 2025 as a denial-of-service issue, but was reclassified as an RCE in March 2026 after F5 obtained new information confirming the true severity. The CVSS score was upgraded from 8.7 to 9.8 (v3.1) and 9.3 (v4.0).

The exploitation is attributed to UNC5221 (also tracked as UTA0178 and Red Dev 61), a China-nexus state-sponsored threat cluster. F5 confirmed on October 16, 2025 that a highly sophisticated nation-state threat actor had maintained access to F5 internal networks for at least 12 months (discovered August 9, 2025). During this intrusion, attackers exfiltrated BIG-IP source code, internal development data, and intelligence about undisclosed vulnerabilities.

Post-compromise, UNC5221 deployed the BRICKSTORM backdoor — a Golang-based, cross-platform implant targeting Linux, Windows, and BSD systems — on F5 customer environments. BRICKSTORM communicates via TLS with HTTP/2 ALPN negotiation, WebSocket upgrades for persistent bidirectional tunnels, and Yamux multiplexing. It uses DNS-over-HTTPS (DoH) for C2 resolution via Cloudflare, Google, and Quad9 resolvers, and leverages cloud services (Cloudflare Workers, Heroku) as reverse proxies to mask traffic.

Observed post-exploitation techniques include: deployment of PHP webshells to /var/sam/www/webtop/renderer/ paths (apm_css.php3, full_wt.php3, webtop_popup_css.php3), though many webshells operate in-memory only; modification of /usr/bin/umount and /usr/sbin/httpd binaries to subvert the sys-eicheck integrity checker; disabling SELinux via iControl REST API from localhost; and reconnaissance via the /mgmt/shared/identified-devices/config/device-info endpoint. Attackers disguise outbound C2 traffic using HTTP 201 response codes with CSS content-type headers.

Attackers modified components only in the running partition, failing to replicate changes to the upgrade destination partition — meaning customers who had already upgraded and rebooted lost attacker modifications, effectively removing the compromise. This is a critical remediation detail.

CISA added CVE-2025-53521 to the Known Exploited Vulnerabilities catalog on March 27, 2026, with a federal remediation deadline of March 30, 2026. The Dutch NCSC has also confirmed observations of active abuse. Over 22 F5 BIG-IP modules are affected across four major version branches.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1106 Native API
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1078 Valid Accounts
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1556 Modify Authentication Process
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1210 Exploitation of Remote Services
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1572 Protocol Tunneling
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1489 Service Stop
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure

## Sources

- [NCSC Advisory: Vulnerability affecting F5 BIG-IP APM](https://www.ncsc.gov.uk/news/vulnerability-affecting-f5-big-ip-apm)
- [F5 Security Advisory K000156741](https://my.f5.com/manage/s/article/K000156741)
- [F5 Indicators of Compromise K000160486](https://my.f5.com/manage/s/article/K000160486)
- [CISA KEV Entry CVE-2025-53521](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521)
- [NVD Entry CVE-2025-53521](https://nvd.nist.gov/vuln/detail/CVE-2025-53521)
- [CISA BRICKSTORM Malware Analysis Report AR25-338A](https://www.cisa.gov/news-events/analysis-reports/ar25-338a)
- [DoD BRICKSTORM Backdoor Malware Analysis Report](https://media.defense.gov/2025/Dec/04/2003834878/-1/-1/0/MALWARE-ANALYSIS-REPORT-BRICKSTORM-BACKDOOR.PDF)
- [Google Mandiant: BRICKSTORM Espionage Campaign](https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign)
- [Help Net Security: Attackers exploiting RCE in BIG-IP APM](https://www.helpnetsecurity.com/2026/03/28/big-ip-apm-vulnerability-cve-2025-53521-exploited/)
- [The Hacker News: CISA Adds CVE-2025-53521 to KEV](https://thehackernews.com/2026/03/cisa-adds-cve-2025-53521-to-kev-after.html)
- [Resecurity: F5 BIG-IP Source Code Leak Tied to BRICKSTORM](https://www.resecurity.com/blog/article/f5-big-ip-source-code-leak-tied-to-state-linked-campaigns-using-brickstorm-backdoor)
- [SecurityWeek: F5 Hack Linked to China](https://www.securityweek.com/f5-hack-attack-linked-to-china-big-ip-flaws-patched-governments-issue-alerts/)
- [ExtraHop: The BRICKSTORM Campaign UNC5221](https://www.extrahop.com/blog/the-brickstorm-campaign-unc5221)
- [Picus Security: BRICKSTORM Malware UNC5221 Analysis](https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0297