UPDATE TO 5/6/22 FLASH UPDATE: As predicted by CTIX analysts, a critical vulnerability affecting F5’s BIG-IP module’s iControl REST component is being actively scanned for and massively exploited by threat actors. The flaw, tracked as CVE-2020-1388, allows unauthenticated attackers to send undisclosed requests bypassing authentication in order to perform arbitrary code execution, potentially leading to a complete system takeover. On May 9, 2022, researchers announced on Twitter that multiple working Proof-of-Concept (PoC) exploits had been created, demonstrating how attackers can utilize the working PoC to access an internet-exposed F5 application endpoint. A researcher from Cronup security has reportedly observed threat actors dropping PHP webshells, executing them, and then purging them from vulnerable systems. While this vulnerability has been successfully patched, however due to the enterprise popularity of F5’s BIG-IP, many organizations have yet to update their instances, due to the negative impact it would have on business processes. If administrators cannot patch their instances at this time, there are three (3) mitigation techniques, which are blocking iControl REST access through the self IP address, blocking iControl REST access through the management interface, and modifying the BIG-IP httpd configuration. According to Shodan, there are still thousands of unpatched vulnerable instances, and the Ankura CTIX team expects to see a steady increase in exploitation of this vulnerability now that working PoC’s are publicly available.