The attackers used a remarkable tactic: lying low for months to allow forensic logs to expire. Waiting to let forensic data expire demonstrates the group's professionalism. The hack at F5 began in late 2023, when attackers exploited a vulnerability in BIG-IP software. According to sources familiar with the incident, F5 staff failed to follow the cybersecurity guidelines that the company provides to customers.
The committee noted that suspected threat actors from China impersonated Republican Party Congressman John Robert Moolenaar in phishing emails sent to trusted counterparts with an aim to deceive them and trick them into opening files and links that would grant them unauthorized access to their systems and sensitive information without their knowledge. The end goal of the attacks was to steal valuable data by abusing software and cloud services to cover up traces of their activity, a tactic often adopted by state-sponsored hackers to evade detection.
