PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory
Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.
On September 8, 2026, SophosLabs published an analysis of Linux/Agnt-IC (dubbed PoisonedRefresh by ESET) found in compromised F5 BIG-IP Access Policy Manager environments. Initial access leverages CVE-2025-53521, an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server; F5 confirmed exploitation and links the activity to cluster c05d5254, while Shadowserver observed 795 exposed vulnerable endpoints. A first stage hidden in a modified umount binary modifies /usr/sbin/httpd and SELinux configuration and embeds itself in BIG-IP upgrade images for persistence. The second-stage ELF intercepts __libc_start_main, hooks apr_dso_load, and injects a PHP web shell into libphp memory via mmap manipulation, leaving no disk artifacts, and exposes a /bin/bash shell via a local UNIX domain socket instead of a TCP port.
- First stage hides in a modified umount binary, modifies SELinux config, and embeds in BIG-IP upgrade images for persistence.
- Second stage intercepts __libc_start_main, hooks apr_dso_load, and injects a PHP web shell into Apache's memory.
- Web shell reads php://input, decrypts RC4-encrypted commands, and replies with HTTP 201 text/css to blend in.
- A UNIX domain socket at /run/bigtlog.pipe provides an interactive /bin/bash session without opening TCP ports.
- Shadowserver observed 795 internet-exposed endpoints vulnerable to CVE-2025-53521 at disclosure.
- CVEs
- CVE-2025-53521
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1574.006 Dynamic Linker HijackingT1014 RootkitT1027 Obfuscated Files or Information
- Products
- BIG-IP APMApachelibphp
- Threat actors
- c05d5254
- Malware
- PoisonedRefreshLinux/Agnt-IC
- Organizations
- SophosLabsShadowserver Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-53521 | Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE | 9.3 | 2% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9 | upgrade images. The SHA-256 hash of the analyzed sample is 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9 . F5 has published remediation and compromise assessment gu |
From the original article
5 min read at securityaffairs.com
PoisonedRefresh rootkit injects PHP web shells into F5 BIG-IP APM Apache memory, leaving no disk artifacts. SophosLabs published a detailed technical analysis on September 8, 2026, of a Linux implant, dubbed PoisonedRefresh by ESET, they found in compromised F5 BIG-IP Access Policy Manager environments. Sophos tracks it as Linux/Agnt-IC.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.