F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence RCE → CVE-2025-33073 Kerberos Relay to Active Directory (Microsoft Defender Research)

F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence (TL-2026-0572), also tracked as F5 BIG-IP SSH Pivot Campaign, is a high-severity tracked intrusion set scored CVSS 8.8, first published 2026-05-23. It has no confirmed attribution, affects F5 BIG-IP Virtual Edition, references 1 CVE (CVE-2025-33073), maps to 31 MITRE ATT&CK techniques (T1005, T1018, T1021), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-0572

Threat ID
TL-2026-0572
Also known as
F5 BIG-IP SSH Pivot Campaign, MalPack.B Linux Toolkit Intrusion
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
MONITORING
Category
THREAT_INTEL
First published
2026-05-23
Last reviewed
2026-05-23
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
enterprise, hybrid-cloud, government, financial, technology, managed-service-providers
Target regions
Global, North America, Europe
Detection rules
9
Indicators of compromise
23

Malware and tooling in F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence

Malware and tooling: HackTool:Linux/MalPack.B, PetitPotam, Responder - S0174, gowitness, kerbrute, netexec (nxc), timeroast

Microsoft Defender Security Research disclosed a multi-stage, identity-focused intrusion in which a threat actor leveraged an Azure-hosted, end-of-life F5 BIG-IP Virtual Edition (v15.1.201000) as the initial-access foothold via SSH with a privileged sudo account. From the F5 Linux shell, the actor staged a custom toolkit (HackTool:Linux/MalPack.B served from 206.189.27[.]39), ran extensive recon (Nmap, gowitness, enum4linux, kerbrute), pivoted to an internal Atlassian Confluence server for RCE, harvested credentials from server.xml and confluence.cfg.xml, then chained Kerberos NTLM-reflection abuse via CVE-2025-33073 (netexec + PetitPotam + responder) to relay coerced authentication to a Domain Controller and obtain Active Directory dominance.

How F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence works

## Incident Overview

Microsoft Defender Security Research published a detailed kill-chain analysis (mid-May 2026) of a hands-on-keyboard intrusion targeting a hybrid enterprise. The actor used an internet-exposed, end-of-life F5 BIG-IP Virtual Edition appliance (software v15.1.201000, EOL 31 December 2024) running in Azure as the initial breach point, then pivoted laterally through an internal Atlassian Confluence server into the on-prem Active Directory environment. The intrusion is notable for (a) using a legitimate network-edge appliance as a covert Linux beachhead, (b) chaining a Windows-side Kerberos relay vulnerability (CVE-2025-33073) from a Linux toolchain, and (c) the operator dropping a custom Linux scanner that Microsoft tagged HackTool:Linux/MalPack.B.

## Stage 1 — Initial Access (F5 BIG-IP SSH)

The F5 BIG-IP Virtual Edition was reachable over SSH from the public Internet. The actor authenticated using a privileged management account that retained sudo rights on the underlying TMOS Linux shell (bash). Microsoft did not publish a CVE-backed exploit for the initial logon — credential theft, weak-credential reuse, or an exposed default service account are all consistent with the artifacts. Once on the box, the actor escalated to root through sudo and used /dev/shm as the primary staging directory, which evades many file-integrity monitors that exclude tmpfs.

## Stage 2 — Tooling Drop and Recon

Using curl and wget against C2 206.189.27[.]39 (DigitalOcean droplet, AS14061), the actor pulled a curated Linux red-team kit into /dev/shm: - A custom scanner Microsoft detects as HackTool:Linux/MalPack.B (SHA256 4a927d031919fd6bd88d3c8a917214b54bca00f8ddc80ecfe4d230663dda7465) - A shell wrapper automating Nmap sweeps (SHA256 b4592cea69699b2c0737d4e19cff7dca17b5baf5a238cd6da950a37e9986f216) - Kerbrute Go binary for Kerberos username enumeration / pre-auth password spray (SHA256 710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122a) - gowitness for HTTP screenshotting of internal web apps (SHA256 57b3188e24782c27fdf72493ce599537efd3187d03b80f8afe733c72d68c5517) - A Python NTLM-relay script wrapping impacket-style primitives (SHA256 bdd5da81ac34d9faa2a5118d4ed8f492239734be02146cd24a0e34270a48a455) - enum4linux, netexec (nxc), smbclient, rpcclient, ldapsearch, timeroast, responder, PetitPotam — pulled either from C2 or installed via pip/apt where available.

## Stage 3 — Internal Pivot and Confluence RCE

Using the recon output, the actor identified an internal Atlassian Confluence instance that was unpatched against a known RCE family (Microsoft did not attribute a specific CVE in their writeup; the artifacts are consistent with the Confluence OGNL-injection class — e.g., CVE-2023-22515 / CVE-2023-22527 — but the actor''s choice was opportunistic). Exploitation produced code execution as the Confluence service account on a Linux host. The actor then read /var/atlassian/application-data/confluence/server.xml and confluence.cfg.xml, which contain database connection strings and the obfuscated (but trivially reversible) Confluence master password. These yielded a privileged service credential reused within the AD environment.

## Stage 4 — Kerberos Relay via CVE-2025-33073 (Identity Compromise)

With a usable AD credential and network access to the internal subnet, the actor combined three open-source primitives: 1. PetitPotam (MS-EFSRPC coercion) was used to force a Domain Controller or other privileged server to authenticate back to the operator-controlled host on the internal subnet. 2. responder/ntlmrelayx-style listener captured the inbound NTLM/Kerberos authentication. 3. The coerced authentication was relayed via SMB to a target where CVE-2025-33073 — an SMB client-side improper-access-control bug allowing NTLM-reflection / Kerberos relay across protocols — enabled the relayed ticket to elevate the attacker to LocalSystem-equivalent rights on the target. The CVE itself was patched by Microsoft in the June 2025 cumulative updates but unpatched DCs and member servers remain widely exposed.

With SYSTEM on a domain-joined target, the actor used netexec (nxc) and timeroast to extract Kerberos ticket material, including AS-REP / TGS hashes for crackable accounts, and ultimately obtained domain-administrator equivalent control.

## Stage 5 — Collection and Persistence

Microsoft observed the actor staging archives in /dev/shm on the F5 appliance for exfiltration via Python ftplib back to operator infrastructure. No long-term persistence implant was deployed on Windows; the actor relied on (a) reusable AD credentials and (b) continued SSH access to the F5 box as their re-entry mechanism. This dual-platform foothold (a Linux edge box with credentials into Windows AD) is the campaign''s defining characteristic.

## Attribution and Significance

Microsoft did not attribute the intrusion to a named threat group. The toolkit (kerbrute + netexec + PetitPotam + responder + gowitness + custom Linux scanner) and the dual Linux/Windows TTP set are consistent with both financially motivated access-broker activity and identity-focused state-aligned tradecraft. The intrusion''s strategic value lies in demonstrating that end-of-life network-edge appliances are not just a patching problem — they become covert, trusted Linux pivots inside enterprise perimeters, ideal for staging cross-platform identity attacks. Every hybrid enterprise running EOL F5/Citrix/Fortinet appliances in cloud or DMZ should treat this writeup as a hunt template.

MITRE ATT&CK techniques used in TL-2026-0572

Collection

T1005 Data from Local System; T1602 Data from Configuration Repository

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1087 Account Discovery; T1482 Domain Trust Discovery

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Defense Evasion

T1070 Indicator Removal; T1564 Hide Artifacts

Command and Control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Credential Access

T1110 Brute Force; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1557 Adversary-in-the-Middle; T1558 Steal or Forge Kerberos Tickets

Impact

T1531 Account Access Removal

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

Affected products and versions in F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence

  • F5 — BIG-IP Virtual Edition
    Vulnerable versions: 15.1.201000 (EOL 2024-12-31); all 15.1.x branches
    Fixed in: 17.x supported branch
  • Microsoft — Windows Server (SMB / Kerberos)
    Vulnerable versions: Server 2012 R2 / 2016 / 2019 / 2022 / 2025 prior to June 2025 cumulative update
    Fixed in: With June 2025 cumulative update applied
  • Atlassian — Confluence Data Center and Server
    Vulnerable versions: Unpatched branches susceptible to OGNL-injection RCE classes
    Fixed in: Latest fixed releases per Atlassian security advisories

Remediation for F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence

Patches

  • Microsoft June 2025 Patch Tuesday (CVE-2025-33073) — apply to all Windows DCs and servers
  • Upgrade F5 BIG-IP off any 15.1.x branch to a supported LTS release (v17.x as of 2026)
  • Apply latest Atlassian Confluence Data Center / Server fixed releases addressing OGNL-injection RCE classes

Immediate actions

  • Block outbound and inbound communication with 206.189.27.39 at perimeter, EDR, and DNS layers
  • Audit all internet-exposed F5 BIG-IP, Citrix ADC/NetScaler, and Fortinet appliances for EOL software versions and disable Internet-facing SSH/management interfaces immediately
  • Hunt for the five published SHA256 hashes across endpoint AV/EDR (HackTool:Linux/MalPack.B family)
  • Audit Confluence server.xml and confluence.cfg.xml access on all Confluence hosts; rotate any database/service credentials stored in those files
  • Apply Microsoft June 2025 cumulative updates that patch CVE-2025-33073 on every Domain Controller and member server
  • Enable SMB signing required (both client and server) and LDAP channel binding/signing across AD

Workarounds

  • If Confluence cannot be patched immediately, restrict network access to the /setup, /server-info, and /rest/* endpoints to known administrators
  • Disable EFS RPC (PetitPotam coercion vector) on DCs where EFS is not required, or block MS-EFSRPC at the network layer between non-administrative subnets and DCs
  • Disable SSH on F5 BIG-IP management interfaces or restrict to a /32 jump host ACL until appliances can be replaced

Longer-term hardening

  • Inventory and decommission all end-of-life network appliances; F5 BIG-IP v15.1.x reached EOL on 31 December 2024
  • Enforce phishing-resistant MFA and dedicated workstations for all appliance management access
  • Segment management interfaces of network appliances behind a jump host / PAW network with no Internet egress
  • Deploy NTLM-relay mitigations: Extended Protection for Authentication (EPA), SMB signing, LDAP signing, disable NTLMv1, monitor for PetitPotam (EFSRPC) traffic to non-DC hosts
  • Treat any Linux appliance with sudo-capable accounts as Tier-0; vault those credentials in a PAM
  • Patch Confluence to the latest fixed branch and rotate the Confluence master encryption key after compromise

CVEs associated with F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence

CVE-2025-33073

Weaknesses (CWE) in F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence

CWE-284, CWE-294, CWE-522, CWE-1188

Timeline of F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence

  • PetitPotam MS-EFSRPC coercion PoC published by topotam on GitHub — primitive later weaponized in this intrusion to coerce DC authentication.
  • F5 BIG-IP v15.1.x branch reached end-of-life per F5 lifecycle policy (K5903). Affected appliance (v15.1.201000) no longer receives security updates.
  • Microsoft published security update for CVE-2025-33073 (SMB improper access control enabling NTLM reflection / Kerberos relay across protocols); CVSS 8.8 HIGH.
  • Estimated earliest window of initial compromise of the Azure-hosted F5 BIG-IP appliance via SSH (per Microsoft Defender Research narrative — exact dwell time not disclosed).
  • Estimated window of internal pivot to Confluence, credential harvesting from server.xml/confluence.cfg.xml, and Kerberos-relay chain to Active Directory.
  • Microsoft Defender Security Research completed analysis, assigned HackTool:Linux/MalPack.B detection name, published five SHA256 hashes and C2 IP 206.189.27.39.
  • Threadlinqs Intelligence published full kill-chain analysis with MITRE mapping, IOCs, and detection coverage.
  • Cyber Security News published public writeup of Microsoft Defender research; TL-2026-0572 opened for tracking.
  • As of 2026-05-29, this remains a live concern: the core relay flaw CVE-2025-33073 is patched (June 2025) yet sits in CISA KEV under active exploitation, and the EOL-F5/unpatched-Confluence/NTLM-relay TTPs stay fully viable. Microsoft's report is one investigated, contained incident by an unattributed actor, so its tooling and primitives could resurge broadly.

Sources cited for F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence

Threats related to F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence

Detection coverage for TL-2026-0572

As of 2026-05-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0572 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats