Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways
Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.
Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.
- Second-stage implant hooks Apache's PHP loader and serves modified in-memory versions of three BIG-IP APM webtop PHP files.
- Files on disk remain unchanged, so hashes match and file-integrity monitoring passes while the system is compromised.
- Implant also opens an authenticated local UNIX socket providing an interactive /bin/bash session, avoiding network-based detection.
- Activity linked to exploitation of CVE-2025-53521, an unauthenticated RCE in BIG-IP APM when an access policy is configured.
- Compromised APM appliances can leak SSO tokens and credentials and enable lateral movement to trusted downstream apps.
- CVEs
- CVE-2025-53521
- Products
- F5 BIG-IP APM
- Organizations
- SophosBeyondTrustColorTokens
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-53521 | Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE | 9.3 | 2% | KEV | KEV |
From the original article
3 min read at csoonline.com
A newly analyzed Linux rootkit is believed to have given attackers a way to hide shells inside recently compromised F5 BIG-IP Access Policy Management (APM) environments, without leaving the malicious PHP code on disk.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.