pwn.watch: China incident updates

[critical] F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen

Wed, 15 Oct 2025 00:00:00 GMT

F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.

Status: closed · Patch: patched · Fixed in: F5 October 2025 Quarterly Security Notification releases

Latest updates:

2025-10-15: F5 discloses the breach (SEC 8-K) and ships patches (source)
2025-10-15: CISA issues Emergency Directive 26-01 for F5 devices (source)
2025-08-09: F5 learns of the intrusion (source)

[critical] Salt Typhoon: Chinese state hackers inside US telecom networks

Wed, 04 Dec 2024 00:00:00 GMT

PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-12-04: CISA, NSA, FBI and Five Eyes partners release hardening guidance for communications infrastructure (source)
2024-11-13: FBI and CISA joint statement on PRC targeting of commercial telecommunications (source)

[critical] Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)

Mon, 16 Oct 2023 00:00:00 GMT

A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.

Status: closed · Patch: patched · Fixed in: 8.3.3, 8.4.3, 8.5.2 (LTS)

Latest updates:

2023-10-16: CISA, FBI and MS-ISAC joint advisory AA23-289A on active exploitation (source)
2023-10-05: CISA adds CVE-2023-22515 to the KEV catalog
2023-10-04: Atlassian discloses the zero-day after customer reports and ships fixes (source)

CVEs: CVE-2023-22515

[critical] Storm-0558: stolen Microsoft signing key used to read government email

Wed, 06 Sep 2023 00:00:00 GMT

China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.

Status: closed · Patch: patched

Latest updates:

2023-09-06: Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network (source)
2023-07-14: Microsoft details how the stolen MSA key was used to forge tokens (source)
2023-07-11: Microsoft discloses the intrusion; CISA and FBI publish AA23-193A (source)

[critical] Barracuda Email Security Gateway zero-day (CVE-2023-2868)

Thu, 15 Jun 2023 00:00:00 GMT

A command injection in how Barracuda ESG appliances scan .tar attachments was exploited since October 2022 by China-nexus UNC4841 to backdoor appliances. Barracuda later told customers to replace compromised appliances outright, even after patching.

Status: closed · Patch: patched · Fixed in: See vendor advisory (patch pushed to all appliances May 20–21, 2023; compromised appliances must be replaced)

Latest updates:

2023-06-15: Mandiant attributes the campaign to China-nexus UNC4841 (source)
2023-06-06: Barracuda tells customers to replace compromised appliances immediately, regardless of patch level (source)
2023-05-30: Barracuda: exploitation dates back to October 2022, with SALTWATER, SEASPY and SEASIDE malware (source)

CVEs: CVE-2023-2868