Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.
Sophos analyzed a Linux rootkit targeting F5 BIG-IP APM environments, also tracked by ESET as PoisonedRefresh, which hijacks Apache's apr_dso_load module loader to inject a fileless PHP web shell into memory. The implant intercepts __libc_start_main, hides strings with RC4, creates a password-protected local UNIX socket backdoor for interactive Bash access, and persists across BIG-IP upgrade images while modifying SELinux configuration. It is likely a second-stage payload following exploitation of CVE-2025-53521, a critical RCE flaw F5 reclassified from a DoS issue in March. The ShadowServer Foundation tracked 795 F5 BIG-IP APM endpoints exposed online.
- Web shell triggers on magic POST requests, executes eval() payloads, and returns HTTP 201 responses disguised as CSS.
- Implant delays backdoor creation during Apache startup to blend with normal runtime behavior.
- Defenders should watch for Apache workers reading /proc/self/maps and creation of /run/bigtlog.pipe.
- On-disk PHP files remain unchanged, shrinking the detection surface.
- CVEs
- CVE-2025-53521
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1055.009 Proc MemoryT1505.003 Web ShellT1059.004 Unix Shell
- Products
- F5 BIG-IP APMApache
- Malware
- PoisonedRefresh
- Organizations
- F5SophosESETShadowServer Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-53521 | Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE | 9.3 | 2% | KEV | KEV |
From the original article
3 min read at bleepingcomputer.com
A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.