Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory
Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.
78
Malware
PoisonedRefresh
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenSep 8, 2026
- Last mentionedSep 9, 2026
Timeline
4 articles · newest firstPoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory
Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.
78
F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Sophos found F5 BIG-IP APM malware that injects a PHP web shell into Apache's memory, evading disk scans, linked to exploited CVE-2025-53521.
72
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.
76
Related CVEs
by mentions- CVE-2025-535212%9.3Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE
Appears with
- ESETvendor · 4
- Sophosvendor · 4
- F5vendor · 4
- Apacheproduct · 3
- libphpproduct · 2
- BIG-IP APMproduct · 2
- F5 BIG-IP APMproduct · 2
- Shadowserver Foundationorganization · 2
- ShadowServer Foundationvendor · 1
- UK NCSCorganization · 1
- c05d5254malware · 1
- Linux/Agnt-ICmalware · 1
- Apache httpdproduct · 1
- Apachevendor · 1
- CISAorganization · 1
- F5organization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.