From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence