Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory
Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.
Sophos and ESET analyzed an implant (named PoisonedRefresh by ESET) deployed on compromised F5 BIG-IP APM appliances, which serves enterprise, financial, government, and public sector deployments. The second-stage payload intercepts __libc_start_main, hooks Apache's APR module loader (apr_dso_load), RC4-encodes key strings, and rewrites PHP file reads in memory to embed a web shell inside legitimate scripts like apm_css.php3, full_wt.php3, and webtop_popup_css.php3, leaving on-disk files unchanged. A related installer component infects /usr/sbin/httpd, persists across BIG-IP upgrade images, modifies SELinux configuration, and deploys the payload. The malware also creates a Unix domain socket at /run/bigtlog.pipe that hands authenticated local connections to /bin/bash; F5 links the activity to CVE-2025-53521, an unauthenticated RCE in BIG-IP APM already exploited in the wild.
- Web shell is injected in memory, so filesystem-focused responders can miss evidence
- Installer persists across BIG-IP upgrade images and alters SELinux settings
- Unix domain socket at /run/bigtlog.pipe provides interactive /bin/bash shell
- Sophos lists IOC checks: .php3 requests, HTTP 201 responses on CSS endpoints, /proc/self/maps reads
- CVEs
- CVE-2025-53521
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1014 RootkitT1027 Obfuscated Files or InformationT1036 Masquerading
- Products
- F5 BIG-IP APMApache httpd
- Malware
- PoisonedRefresh
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-53521 | Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE | 9.3 | 2% | KEV | KEV |
From the original article
3 min read at helpnetsecurity.com
A rootkit found on hacked F5 BIG-IP APM devices skips the usual step of writing a web shell to disk, hiding it in memory instead, according to Sophos. F5 BIG-IP APM provides access policy enforcement to secure access to apps, APIs, and data. It’s primarily used by enterprises, financial institutions, government agencies, and public sector organizations.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.