In-memory Linux rootkit 'PoisonedRefresh' hides web shell on hacked F5 BIG-IP APM appliances
Sophos and ESET analyzed a stealth Linux rootkit, named PoisonedRefresh by ESET, on compromised F5 BIG-IP APM appliances that injects a web shell into memory so on-disk files stay unchanged, linked to exploitation of CVE-2025-53521, an unauthenticated RCE in…
Sophos, together with ESET (which named the implant PoisonedRefresh), analyzed a second-stage Linux rootkit found on compromised F5 BIG-IP APM appliances used in enterprise, financial, government, and public sector deployments. The implant intercepts __libc_start_main, hooks Apache's APR module loader (apr_dso_load, the process that loads PHP), RC4-encodes key strings, and rewrites PHP file reads in memory so requests to three legitimate webtop scripts — apm_css.php3, full_wt.php3, and webtop_popup_css.php3 — return versions with an embedded web shell, while on-disk files remain untouched and hashes and file-integrity monitoring pass. A related installer component infects /usr/sbin/httpd, persists across BIG-IP upgrade images, and modifies SELinux configuration. The malware also creates a Unix domain socket at /run/bigtlog.pipe that hands authenticated local connections an interactive /bin/bash shell, avoiding network-based detection. F5 links the activity to CVE-2025-53521, an unauthenticated RCE in BIG-IP APM that CSO Online reports is exploitable when an access policy is configured, and that Help Net Security says is already exploited in the wild. CSO Online warns that compromised APM gateways, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token and credential theft and lateral movement to trusted downstream applications. Sophos lists IOC checks including .php3 requests, HTTP 201 responses on CSS endpoints, and /proc/self/maps reads.
- Affected product: F5 BIG-IP APM appliances running Apache and PHP, used in enterprise, financial, government, and public sector deployments.
- Implant: second-stage Linux rootkit tracked as PoisonedRefresh (name by ESET); analyzed by Sophos and ESET.
- Linked vulnerability: CVE-2025-53521, an unauthenticated RCE in BIG-IP APM; CSO Online notes exploitation requires an access policy to be configured; Help Net Security reports it is already exploited in the wild.
- Web shell is injected in memory into three legitimate webtop PHP files: apm_css.php3, full_wt.php3, and webtop_popup_css.php3; on-disk files are unchanged, so hashes and file-integrity checks pass and filesystem-focused responders can miss…
- Techniques: intercepts __libc_start_main, hooks Apache's APR module loader (apr_dso_load), and RC4-encodes key strings.
- Installer component infects /usr/sbin/httpd, persists across BIG-IP upgrade images, and modifies SELinux configuration.
- Access channel: Unix domain socket at /run/bigtlog.pipe gives authenticated local connections an interactive /bin/bash shell, avoiding network-based detection.
- Impact risk: compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could leak SSO tokens and credentials and enable lateral movement to trusted downstream applications.
Coverage timelineoldest first · each row is one article
- · 7d agoHackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memory
Help Net Security· 78
Sophos analyzed a Linux rootkit, tracked as PoisonedRefresh, on hacked F5 BIG-IP APM devices hiding an in-memory web shell linked to exploited CVE-2025-53521.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-53521 | Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE CVE-2025-53521 is a stack-based buffer overflow (CWE-121) in F5 BIG-IP's Access Policy Manager (APM) that allows remote code execution. The flaw is triggered when a virtual server is configured with an APM access policy and receives specific malicious network traffic; no authentication or user interaction is required per the CVSS 4.0 vector. An attacker who exploits it gains remote code execution on the BIG-IP device, and in observed intrusions attackers have deployed a fileless Linux rootkit (dubbed 'PoisonedRefresh') that injects a PHP web shell into server memory to evade disk-based scanning. Any F5 BIG-IP deployment with an APM access policy configured on a virtual server is potentially affected; versions that have reached End of Technical Support are not evaluated by the vendor. The vulnerability is being actively exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-27, with active exploitation and in-memory malware campaigns confirmed in press reports, though ransomware use is unknown. Do: Patch immediately by upgrading affected BIG-IP systems to fixed releases per F5's security advisory (note that versions in End of Technical Support will not be fixed and should be upgraded or retired), prioritizing internet-facing virtual servers with APM access policies. Because observed attacks deploy a memory-resident PHP web shell via the PoisonedRefresh Linux rootkit, disk-only scans may miss compromise — inspect running processes and memory, and hunt for suspicious PHP or rootkit activity on BIG-IP APM devices. Federal agencies must follow the required action in CISA KEV/BOD 22-01: apply vendor mitigations or discontinue use of the product if mitigations are unavailable. | 9.3 | 2% | KEV |
| large≈14,000+ internet-exposed F5 BIG-IP devices (per public scan figures cited in press coverage) |