Daily Briefing for 10.16.25

Top stories.

• F5 discloses long-term breach tied to nation-state actors.
• Phishing campaign impersonates LastPass and Bitwarden.
• PowerSchool hacker receives a four-year prison sentence.

F5 discloses long-term breach tied to nation-state actors.

Seattle-based cybersecurity firm F5 disclosed yesterday that state-sponsored hackers had "long-term, persistent access" to its networks, leading to the theft of source code and customer information, TechCrunch reports. The company says the hackers had access to the development environment for its BIG-IP product suite and its engineering knowledge management platform.

The company said in an SEC filing, "Through this access, certain files were exfiltrated, some of which contained certain portions of the Company’s BIG-IP source code and information about undisclosed vulnerabilities that it was working on in BIG-IP. We are not aware of any undisclosed critical or remote code vulnerabilities, and we are not aware of active exploitation of any undisclosed F5 vulnerabilities. We have no evidence of modification to our software supply chain, including our source code and our build and release pipelines."

Bloomberg cites people familiar with the matter as saying the hack is believed to be linked to China, and that the hackers were inside F5's networks for at least twelve months. Ars Technica notes that F5's BIG-IP line is used across the US government and by most of the largest companies in the world.

The US Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive ordering Federal civilian agencies to immediately inventory F5 devices and apply the latest updates by October 22nd. The agency stated, "The threat actor’s access to F5’s proprietary source code could provide that threat actor with a technical advantage to exploit F5 devices and software. The threat actor’s access could enable the ability to conduct static and dynamic analysis for identification of logical flaws and zero-day vulnerabilities as well as the ability to develop targeted exploits."

Phishing campaign impersonates LastPass and Bitwarden.

BleepingComputer reports that a phishing campaign is impersonating LastPass and Bitwarden with phony breach notifications. The emails claim the companies have been hacked, and instruct users to install a more secure version of the password managers. This file will download the Syncro remote monitoring and management tool, which the attackers use to install ScreenConnect software. ScreenConnect is a legitimate remote management tool, but is frequently abused by attackers to take control of victims' computers.

LastPass issued a statement on the phishing campaign, noting, "To be clear, LastPass has NOT been hacked, and this is an attempt on the part of a malicious actor to draw attention and generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails."

PowerSchool hacker receives a four-year prison sentence.

19-year-old Matthew Lane of Massachusetts has been sentenced to four years in prison after pleading guilty to hacking education software provider PowerSchool, the Record reports. Lane stole information belonging to more than 70 million individuals and demanded a ransom of $2.9 million in exchange for not publishing the data. In addition to his prison sentence, Lane has been ordered to pay $14 million in restitution and a $25,000 fine.