# F5 BIG-IP Edge Appliance Abused for SSH Pivot → Confluence RCE → CVE-2025-33073 Kerberos Relay to Active Directory (Microsoft Defender Research)

> Microsoft Defender Security Research disclosed a multi-stage, identity-focused intrusion in which a threat actor leveraged an Azure-hosted, end-of-life F5 BIG-IP Virtual Edition (v15.1.201000) as the initial-access foothold via SSH with a privileged sudo account. From the F5 Linux shell, the actor staged a custom toolkit (HackTool:Linux/MalPack.B served from 206.189.27[.]39), ran extensive recon (Nmap, gowitness, enum4linux, kerbrute), pivoted to an internal Atlassian Confluence server for RCE, harvested credentials from server.xml and confluence.cfg.xml, then chained Kerberos NTLM-reflection abuse via CVE-2025-33073 (netexec + PetitPotam + responder) to relay coerced authentication to a Domain Controller and obtain Active Directory dominance.

- **Published:** 2026-05-23T12:00:00Z
- **Last reviewed:** 2026-05-23T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0572
- **ID:** TL-2026-0572
- **Severity:** HIGH (CVSS 8.8)
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-33073, CVE-2023-22515

## Description

## Incident Overview

Microsoft Defender Security Research published a detailed kill-chain analysis (mid-May 2026) of a hands-on-keyboard intrusion targeting a hybrid enterprise. The actor used an internet-exposed, end-of-life F5 BIG-IP Virtual Edition appliance (software v15.1.201000, EOL 31 December 2024) running in Azure as the initial breach point, then pivoted laterally through an internal Atlassian Confluence server into the on-prem Active Directory environment. The intrusion is notable for (a) using a legitimate network-edge appliance as a covert Linux beachhead, (b) chaining a Windows-side Kerberos relay vulnerability (CVE-2025-33073) from a Linux toolchain, and (c) the operator dropping a custom Linux scanner that Microsoft tagged HackTool:Linux/MalPack.B.

## Stage 1 — Initial Access (F5 BIG-IP SSH)

The F5 BIG-IP Virtual Edition was reachable over SSH from the public Internet. The actor authenticated using a privileged management account that retained sudo rights on the underlying TMOS Linux shell (bash). Microsoft did not publish a CVE-backed exploit for the initial logon — credential theft, weak-credential reuse, or an exposed default service account are all consistent with the artifacts. Once on the box, the actor escalated to root through sudo and used /dev/shm as the primary staging directory, which evades many file-integrity monitors that exclude tmpfs.

## Stage 2 — Tooling Drop and Recon

Using curl and wget against C2 206.189.27[.]39 (DigitalOcean droplet, AS14061), the actor pulled a curated Linux red-team kit into /dev/shm:
- A custom scanner Microsoft detects as HackTool:Linux/MalPack.B (SHA256 4a927d031919fd6bd88d3c8a917214b54bca00f8ddc80ecfe4d230663dda7465)
- A shell wrapper automating Nmap sweeps (SHA256 b4592cea69699b2c0737d4e19cff7dca17b5baf5a238cd6da950a37e9986f216)
- Kerbrute Go binary for Kerberos username enumeration / pre-auth password spray (SHA256 710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122a)
- gowitness for HTTP screenshotting of internal web apps (SHA256 57b3188e24782c27fdf72493ce599537efd3187d03b80f8afe733c72d68c5517)
- A Python NTLM-relay script wrapping impacket-style primitives (SHA256 bdd5da81ac34d9faa2a5118d4ed8f492239734be02146cd24a0e34270a48a455)
- enum4linux, netexec (nxc), smbclient, rpcclient, ldapsearch, timeroast, responder, PetitPotam — pulled either from C2 or installed via pip/apt where available.

## Stage 3 — Internal Pivot and Confluence RCE

Using the recon output, the actor identified an internal Atlassian Confluence instance that was unpatched against a known RCE family (Microsoft did not attribute a specific CVE in their writeup; the artifacts are consistent with the Confluence OGNL-injection class — e.g., CVE-2023-22515 / CVE-2023-22527 — but the actor''s choice was opportunistic). Exploitation produced code execution as the Confluence service account on a Linux host. The actor then read /var/atlassian/application-data/confluence/server.xml and confluence.cfg.xml, which contain database connection strings and the obfuscated (but trivially reversible) Confluence master password. These yielded a privileged service credential reused within the AD environment.

## Stage 4 — Kerberos Relay via CVE-2025-33073 (Identity Compromise)

With a usable AD credential and network access to the internal subnet, the actor combined three open-source primitives:
1. PetitPotam (MS-EFSRPC coercion) was used to force a Domain Controller or other privileged server to authenticate back to the operator-controlled host on the internal subnet.
2. responder/ntlmrelayx-style listener captured the inbound NTLM/Kerberos authentication.
3. The coerced authentication was relayed via SMB to a target where CVE-2025-33073 — an SMB client-side improper-access-control bug allowing NTLM-reflection / Kerberos relay across protocols — enabled the relayed ticket to elevate the attacker to LocalSystem-equivalent rights on the target. The CVE itself was patched by Microsoft in the June 2025 cumulative updates but unpatched DCs and member servers remain widely exposed.

With SYSTEM on a domain-joined target, the actor used netexec (nxc) and timeroast to extract Kerberos ticket material, including AS-REP / TGS hashes for crackable accounts, and ultimately obtained domain-administrator equivalent control.

## Stage 5 — Collection and Persistence

Microsoft observed the actor staging archives in /dev/shm on the F5 appliance for exfiltration via Python ftplib back to operator infrastructure. No long-term persistence implant was deployed on Windows; the actor relied on (a) reusable AD credentials and (b) continued SSH access to the F5 box as their re-entry mechanism. This dual-platform foothold (a Linux edge box with credentials into Windows AD) is the campaign''s defining characteristic.

## Attribution and Significance

Microsoft did not attribute the intrusion to a named threat group. The toolkit (kerbrute + netexec + PetitPotam + responder + gowitness + custom Linux scanner) and the dual Linux/Windows TTP set are consistent with both financially motivated access-broker activity and identity-focused state-aligned tradecraft. The intrusion''s strategic value lies in demonstrating that end-of-life network-edge appliances are not just a patching problem — they become covert, trusted Linux pivots inside enterprise perimeters, ideal for staging cross-platform identity attacks. Every hybrid enterprise running EOL F5/Citrix/Fortinet appliances in cloud or DMZ should treat this writeup as a hunt template.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1548 Abuse Elevation Control Mechanism
- T1068 Exploitation for Privilege Escalation
- T1564 Hide Artifacts
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1558 Steal or Forge Kerberos Tickets
- T1557 Adversary-in-the-Middle
- T1046 Network Service Discovery
- T1482 Domain Trust Discovery
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1602 Data from Configuration Repository
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1095 Non-Application Layer Protocol
- T1048 Exfiltration Over Alternative Protocol
- T1531 Account Access Removal

## Sources

- [Hackers Exploit F5 BIG-IP Appliance to Gain SSH Access and Pivot Into Enterprise Linux Networks](https://cybersecuritynews.com/f5-big-ip-exploited-for-ssh-access/)
- [Microsoft Security Update Guide — CVE-2025-33073](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073)
- [NVD — CVE-2025-33073 (Windows SMB Improper Access Control)](https://nvd.nist.gov/vuln/detail/CVE-2025-33073)
- [F5 BIG-IP 15.1.x End-of-Life Notice](https://my.f5.com/manage/s/article/K5903)
- [PetitPotam — MS-EFSRPC Coercion PoC](https://github.com/topotam/PetitPotam)
- [netexec (formerly CrackMapExec)](https://github.com/Pennyw0rth/NetExec)
- [kerbrute — Kerberos username enumeration and password spray](https://github.com/ropnop/kerbrute)
- [gowitness — Web screenshot utility used in offensive recon](https://github.com/sensepost/gowitness)
- [Atlassian Confluence OGNL Injection RCE Family (CVE-2023-22515 / CVE-2023-22527)](https://confluence.atlassian.com/security/security-advisories)
- [MITRE ATT&CK — T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0572