F5 Networks
All Connections
3 total
All Connections
3 totalF5's failure to disclose Russia IP chain risk in 10-K risk factors (FY2019-FY2020) despite naming Moscow as dev center is likely the core fraud theory in three 2025-2026 securities class actions. The Moscow code dependency (93.6% security-critical code) and Lynwood IP claim (Dec 2019) were material undisclosed risks.
Post-2022 'closure' of Moscow office has not reduced Moscow's operational control of nginx security-critical code. Kandaurov and Arutyunyan continue as sole significant contributors at UTC+3 timezone while F5 Western bench produced only 32 commits across 14 people in 7 years.
Arutyunyan's shift from [email protected] to personal gmail.com (Aug 2024) while continuing to commit security-critical nginx code from UTC+3 suggests F5 may be engaging him as Russia-based contractor to avoid sanctions compliance optics while retaining code dependency.
All Findings
5 total
All Findings
5 totalfinancial (2)
F5 booked $509.4M goodwill and $89.3M intangible assets from the $670M NGINX acquisition; Lynwood demands all supporting valuations, including developed technologies ($62.5M), customer relationships ($12M), trade name ($14.5M), and non-competition agreements ($300K)
F5 RFP requests 41-44 target specific financial disclosures from F5's 10-K (Nov 15, 2019, FY2019). Request 41 quotes F5's goodwill statement: 'The goodwill related to the NGINX acquisition is comprised primarily of expected synergies from combining operations and the acquired intangible assets that do not qualify for separate recognition.' Request 42 targets the $509,414,000 goodwill valuation (page 56 of 10-K). Request 43 targets intangible assets at $89,300,000. Request 44 targets purchase price allocation: Net tangible assets $44,494,000; Developed technologies $62,500,000; Customer relationships $12,000,000; Trade name $14,500,000; Non-competition agreements $300,000; Goodwill $509,414,000. Request 51 targets the goodwill reduction of $6M in the post-close measurement period (from 10-Q, Q3 FY2020).
Lynwood demanded F5's Merger Agreement escrow details: $2M deposited for post-closing purchase price adjustment and 1% of Merger Consideration for indemnification obligations, plus Fortis Advisors LLC communications and Nginx Acquisition Equity Incentive Plan
F5 RFP request 34 quotes the F5 Form 8-K (March 11, 2019): 'At the closing of the Merger, F5 will deposit with an escrow agent (i) $2,000,000 of the Merger Consideration to fund potential payment obligations of certain former securityholders of Nginx with respect to a post-closing purchase price adjustment, and (ii) 1% of the Merger Consideration to fund potential post-closing indemnification obligations of certain former securityholders of Nginx, on the terms and conditions set forth in the Merger Agreement. To supplement the potential post-closing indemnification obligations for breaches of Nginx's representations and warranties and certain other matters, F5 has obtained an insurance policy, the costs and expenses of which are shared equally by F5 and Nginx's securityholders (subject to the condition that Nginx's securityholders will not be required to pay in excess of $1,000,000 in the aggregate for such costs and expenses).' Request 36 targets Escrow Agreement, Shareholder Consent, and Joinder Agreement. Requests 54-55 target the Nginx Acquisition Equity Incentive Plan and Nginx 2011 Share Plan (from F5 10-K page 66). Requests 56-57 demand all communications with and concerning Fortis Advisors LLC, who was a party to the Merger Agreement. Request 50 demands all consideration paid to Co-Defendants.
legal (1)
Lynwood demanded all F5 due diligence documents for the $670M NGINX merger, including third-party provider due diligence and board meeting minutes — suggesting F5 either failed to discover or willfully ignored Rambler's IP claims
F5 RFP requests 6-7 demand all due diligence documents and communications, including due diligence by third-party providers, investment advisors, financial consultants, and technical consultants. Request 8 demands board meeting minutes about the merger. Request 17 targets the valuation and calculation of the Total Closing Consideration of $670M. Request 32 targets IP rights allegedly acquired. Requests 85-86 specifically target F5's knowledge of Rambler's ownership claims. Request 220 asks about F5's knowledge or anticipation that criminal or civil litigation could occur concerning Rambler/Lynwood's alleged interest in NGINX.
intelligence (1)
F5 10-K confirms Moscow as NGINX development center but risk factors contain zero Russia-specific disclosures
F5 10-K FY2019 (Item 1) explicitly states: 'NGINX products are developed in San Francisco, California; Cork, Ireland; and Moscow, Russia.' However, neither the FY2019 risk factors (65,856 chars) nor the FY2020 risk factors (66,866 chars) mention Russia, Moscow, Rambler, or any Russia-specific risks. Despite acquiring a company whose core product development occurred in Moscow through Nginx LLC, F5 disclosed no geopolitical, sanctions, or IP-ownership risks specific to Russia. The Rambler raid/IP claim surfaced approximately 6 months after closing (December 2019) and was likewise not mentioned in any subsequent 10-K risk factors reviewed. The DEF 14A proxy statement also contains no mention of Russia, Sysoev, Konovalov, or Rambler.
negative_result (1)
LittleSis: No personnel bridge found between Beloussov/Runa orbit and F5 Networks at depth 2
Comprehensive LittleSis cross-referencing of the Beloussov network (92 entities at depth 2, including Runa Capital, DFJ Fund VIII, Tim Draper, Masha Bucher, Vera Shokina, GVA Capital) against the F5 Networks network (28 entities including all board members and executives) found zero shared entity IDs. Also checked depth-2 from the F5 side (relationships of CEO Locoh-Donou, board members Chadwick, Combes, Scott Thompson) — still no overlap. NGINX, Acronis, and Parallels do not exist in LittleSis. NEA (New Enterprise Associates) also showed no overlap with either network.