60
60
PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory
Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.
On September 8, 2026, SophosLabs published an analysis of Linux/Agnt-IC (dubbed PoisonedRefresh by ESET) found in compromised F5 BIG-IP Access Policy Manager environments. Initial access leverages CVE-2025-53521, an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server; F5 confirmed exploitation and links the activity to cluster c05d5254, while Shadowserver observed 795 exposed vulnerable endpoints. A first stage hidden in a modified umount binary modifies /usr/sbin/httpd and SELinux configuration and embeds itself in BIG-IP upgrade images for persistence. The second-stage ELF intercepts __libc_start_main, hooks apr_dso_load, and injects a PHP web shell into libphp memory via mmap manipulation, leaving no disk artifacts, and exposes a /bin/bash shell via a local UNIX domain socket instead of a TCP port.
78
60
60
60
60
60
60
60
60
60
60
60
60
60
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.
Sophos analyzed a Linux rootkit targeting F5 BIG-IP APM environments, also tracked by ESET as PoisonedRefresh, which hijacks Apache's apr_dso_load module loader to inject a fileless PHP web shell into memory. The implant intercepts __libc_start_main, hides strings with RC4, creates a password-protected local UNIX socket backdoor for interactive Bash access, and persists across BIG-IP upgrade images while modifying SELinux configuration. It is likely a second-stage payload following exploitation of CVE-2025-53521, a critical RCE flaw F5 reclassified from a DoS issue in March. The ShadowServer Foundation tracked 795 F5 BIG-IP APM endpoints exposed online.
76
60
IT threat evolution Q2 2022
60
60
60
60
60
60
60
60
60
60
60
60
⚡ Weekly Recap: Chrome 0-Day, AI Hacking Tools, DDR5 Bit
60
60
60
60
60
60
60
60
60
60