F5 Labs

@f5labs.bsky.social

44 Followers 14 Following

Data driven cyber security threat research from the appsec experts at @f5inc.bsky.social https://f5.com/labs

F5 Labs chart shows 'Total Events per Malware Distribution IP Address.' IP 74.194.191.52 had the most events, nearly 3,000. Followed by 83.252.42.112 with approximately 300. 38.59.219.27 and 192.183.232.142 had minimal events.
Preparing for PQC Checklist: Inventory where crypto lives (TLS, VPNs, APIs); Update libraries, HSMs, load balancers, proxies; validate PQC support; Pilot hybrid TLS with key partners. An illustration of a checklist board.
Blue background with white text asking, "As AI usage scales, which issue hits you the hardest?" Below, the "f5 Labs Threat Research" logo appears. The background has a subtle dotted pattern.
What's your top concern when deploying AI apps?
Cybersecurity Awareness Month with F5 Labs. Text reads "Research-backed tips on Web Apps, APIs, Bots, PQC all month long." Graphic of cloud with the word "app" on a square and a shield with a checkmark in it.
F5 Labs image titled, "THREATS: Insights on How Attackers Exploit Accidental Exposure Flaws." It features a hooded figure using a laptop with a globe and arrows, alongside an orange warning sign.
A graph titled "THREATS Top CVEs: August 2025" from Labs THREAT RESEARCH, shows colored lines trending from August 2024 to August 2025. A purple line peaks in February/March 2025. Green peaks in September 2024.
Threat analysis from F5 Labs shows the top 5 URLs targeted by IP 78.153.140.203. URLs ending in /.env are highly targeted, with the base /.env having nearly 1800 counts of unique URLs.
FIPS203 defines encryption standard, keeping data private during transmission. The algorithm, CRYSTALS-Kyber, is now ML-KEM. "Swipe for more >". F5 Labs Threat Research logo in the upper-right corner.
Senor Intel Series: CVE-2017-9841 saw a 36% increase in scanning traffic in July, vs. June 2025. Donut chart illustrates PHPUNIT EVAL-STDIN.PHP in blue, gray fill. F5 Labs logo in upper right.
Senior Intel Series: Heading the Prevalence of Web-Based RCE Vulnerabilities. HTTP Vectors Lead the Latest CVE Scans. It shows a blue cloud with an arrow and a red shield with a checkmark.
SparkRAT. YARA Rules for Detecting the SparkRAT Client. A grey gear graphic on the right, with blue cloud design including a white rat with a lightning bolt.
Graph titled "THREATS Top CVEs: July 2025," from F5 Labs, shows fluctuations of threats from July to July. One threat surges dramatically from Jan to Apr, dwarfing others, while several other threats remain consistently low.
F5 Labs post with text: "In today's digital landscape, where applications and APIs are the lifeblood of businesses, a silent threat lurks: sophisticated bot adversaries." It also features David Warburton, Director of F5 Labs.
Black background with a blue globe graphic surrounded by blue and orange dots and orange robot icons. Text states: 'Bots are responsible for over 50% of website & API traffic.' F5 Labs logo in corner.
A graphic with the text "ENCRYPTION Preparing for Q-Day: What You Need to Know" along with "Explore our evaluation of PQC & learn essential steps to protect your data.", with the F5 labs logo.
Credential Stuffing: This prevalent attack exploits stolen credentials to gain access to user accounts. Many organizations experience significant login traffic leading to compromised accounts despite low success rates. F5 Labs logo.
Horizontal bar graph showing 'Proportion of PQC Enabled Sites per Business Sector'. Orange bars represent 'Non-PQC', blue bars 'PQC Enabled'. Sectors include Oil & Gas, Utilities, and Consumer Services with varying percentages.
Diagram of SparkRAT architecture. A computer labeled "SparkRAT Infected Host" connects to a cloud labeled "SparkRAT C2 Server" which connects to a person next to a skull and crossbones labeled "SparkRAT Operator Console."
F5 Labs presents: "Bots and Automated Attacks - Staying Ahead of the Curve: Combatting Bot Attacks in Vulnerable Industries." Learn about evolving security and adaptations against threats. The background has scattered blue and bronze dots.
A man with a white shirt stands against a gradient blue background. Text reads: 'INTERVIEW What EU’s PQC Roadmap Means on the Ground Interview with Help Net Security on how organizations can take practical steps to secure their data.'
On a black background, the text reads 'THREATS' in green at the top left. Below it, 'SparkRAT: Exploring Architectural Weakness in Open-source Offensive Tools' is displayed in white. An illustration of a cloud and a mouse icon is present, symbolizing a cybersecurity theme.
Text on a dark, geometric background reads: 'Companies Must Protect Themselves Against Bots Bypassing Defenses.' Below, 'By: David Warburton' is noted. A blurred face of a man in a gray blazer is on the right side, further emphasizing the text.
On a dark background, the text reads: 'Staying Ahead of the Curve: Combating Bot Attacks in Vulnerable Industries.' There are colorful circular icons scattered on the right. Below, it says: 'Learn about the evolving security landscape & necessary adaptations to protect against heightened threats.'
A digital image featuring a barrel with a red prohibition sign overlay, symbolizing the NoBooze1 malware. Text reads: 'SENSOR INTEL SERIES' and 'NoBooze1 Malware Targets TP-Link Routers via CVE-2019-9082'. The tagline 'Unpacking the mechanics of NoBooze1' is displayed beneath.
On a black background, the text reads: 'The State of Post-Quantum Cryptography (PQC) on the Web.' Next to it is a blue circular graphic indicating a statistic: '91.4% of the top 1M sites don’t support PQC.'
On a black background, the text reads: 'Do You Know Your Cryptographic Cover Time?' in bold white letters, next to a blue gear icon containing an hourglass shape in the center.
A heat map visually representing the targeting frequency of different exploit families related to TP-Link CVE-2023-1389, organized by week. The color gradient indicates intensity, with higher values shown in darker shades. Key data points include week dates and total exploits observed.