Hackers breach F5 BIG-IP APM devices with Linux rootkit

Sophos researchers analyzed a Linux rootkit targeting F5 BIG-IP APM environments. The malware can intercept PHP file loading and inject a fileless web shell directly into memory, leaving legitimate PHP files unchanged.

The researchers said the malware was likely deployed after attackers exploited CVE-2025-53521, a critical remote code execution flaw. ESET identified the same malware as PoisonedRefresh.

A separate installer infected the Apache /usr/sbin/httpd executable, modified SELinux settings, and persisted across BIG-IP upgrade images. The rootkit hides operational strings with RC4, runs before the host application starts by intercepting __libc_start_main, and hooks Apache’s PHP module loader through apr_dso_load.

It modifies PHP scripts in memory, including apm_css.php3, full_wt.php3, and webtop_popup_css.php3. The injected web shell accepts specially formatted requests, decrypts them, executes PHP code through eval(), and returns HTTP 201 responses disguised as CSS.

The malware also creates a password-protected local UNIX socket that can launch an interactive Bash shell without opening a TCP listening port. Sophos listed suspicious activity such as reading /proc/self/maps, changing libphp memory protections, creating /run/bigtlog.pipe, and launching /bin/bash. ShadowServer reported 795 exposed endpoints.