Fileless Linux rootkit 'PoisonedRefresh' injects in-memory PHP web shell into F5 BIG-IP APM appliances
Sophos and ESET analyzed a fileless Linux rootkit (SophosLabs: Linux/Agnt-IC; ESET: PoisonedRefresh) on compromised F5 BIG-IP APM appliances that hijacks Apache's module loader to inject a memory-only PHP web shell, likely following exploitation of…
Sophos and ESET analyzed a fileless Linux rootkit deployed on compromised F5 BIG-IP Access Policy Manager (APM) appliances, which serve enterprise, financial, government, and public sector deployments (Help Net Security). ESET tracks the implant as PoisonedRefresh and, per Security Affairs, SophosLabs detects it as Linux/Agnt-IC. Sources differ on the Sophos publication date: The Hacker News cites a September 7, 2026 analysis, while Security Affairs says SophosLabs published on September 8, 2026; BleepingComputer covered the story on September 8, 2026, The Hacker News, Security Affairs, and Help Net Security followed on September 9, 2026, and CSO Online on September 10, 2026. F5 confirmed exploitation in the wild and linked the activity to its cluster c05d5254 and to CVE-2025-53521 (The Hacker News, Security Affairs, Help Net Security); Sophos assessed the rootkit as a likely second-stage payload following exploitation of that flaw (BleepingComputer), an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server (Security Affairs, CSO Online). BleepingComputer adds that F5 reclassified the flaw from a DoS issue in March. CVE-2025-53521 is rated 9.8 CVSS 3.1, was patched in October 2025 (The Hacker News notes that patch remains valid), and was added to CISA KEV on March 27, 2026 (The Hacker News). The Shadowserver Foundation observed 795 internet-exposed F5 BIG-IP APM endpoints vulnerable to CVE-2025-53521 at disclosure (BleepingComputer, Security Affairs). A first-stage installer hidden in a modified umount binary runs before Apache starts and infects /usr/sbin/httpd; it modifies the SELinux configuration (per ESET it disables SELinux), embeds itself in BIG-IP upgrade images for persistence, and deploys the second-stage payload (The Hacker News, Security Affairs, Help Net Security). The second-stage ELF intercepts __libc_start_main, hooks Apache's apr_dso_load module loader, and modifies the libphp PHP module in memory via mmap manipulation (Help Net Security describes it as rewriting PHP file reads in memory), injecting a PHP web shell when Apache loads apm_css.php3, full_wt.php3, or webtop_popup_css.php3; on-disk PHP files remain unchanged, so hashes and file-integrity checks pass while the system is compromised, and filesystem-focused responders can miss evidence. The web shell triggers on crafted (magic) POST requests, reads php://input, decrypts RC4-encrypted commands, executes eval() payloads, and responds with HTTP…
- Naming and attribution: ESET tracks the implant as PoisonedRefresh; SophosLabs detects it as Linux/Agnt-IC; F5 links the activity to cluster c05d5254.
- CVE-2025-53521: unauthenticated RCE in F5 BIG-IP APM when an access policy is configured on a virtual server; CVSS 3.1 score 9.8; patched October 2025 (The Hacker News notes the patch remains valid); added to CISA KEV on March 27, 2026; F5…
- F5 confirmed exploitation in the wild; Sophos assessed the rootkit as a likely second-stage payload following exploitation of CVE-2025-53521.
- Exposure: Shadowserver observed 795 internet-exposed F5 BIG-IP APM endpoints vulnerable to the flaw at disclosure.
- Stage 1: a modified umount binary runs before Apache starts, infects /usr/sbin/httpd, modifies the SELinux configuration (per ESET it disables SELinux), persists across BIG-IP upgrade images, and deploys the second-stage payload.
- Stage 2: an ELF implant intercepts __libc_start_main, hooks Apache's apr_dso_load module loader, and modifies the libphp module in memory via mmap manipulation, injecting the web shell when Apache loads apm_css.php3, full_wt.php3, or…
- Fileless behavior: on-disk PHP files remain unchanged, so hashes and file-integrity monitoring pass while the system is compromised; filesystem-focused responders can miss evidence.
- Web shell mechanics: triggers on magic POST requests, reads php://input, decrypts RC4-encrypted commands, executes eval() payloads, and replies with HTTP 201 and a CSS content type; the implant hides key strings with RC4 and delays…
Coverage timelineoldest first · each row is one article
- · 7d agoHackers breach F5 BIG-IP APM devices to deploy Linux rootkit
BleepingComputer· 76
Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-53521 | Stack-Based Buffer Overflow in F5 BIG-IP APM Enables Unauthenticated RCE CVE-2025-53521 is a stack-based buffer overflow (CWE-121) in F5 BIG-IP's Access Policy Manager (APM) that allows remote code execution. The flaw is triggered when a virtual server is configured with an APM access policy and receives specific malicious network traffic; no authentication or user interaction is required per the CVSS 4.0 vector. An attacker who exploits it gains remote code execution on the BIG-IP device, and in observed intrusions attackers have deployed a fileless Linux rootkit (dubbed 'PoisonedRefresh') that injects a PHP web shell into server memory to evade disk-based scanning. Any F5 BIG-IP deployment with an APM access policy configured on a virtual server is potentially affected; versions that have reached End of Technical Support are not evaluated by the vendor. The vulnerability is being actively exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-27, with active exploitation and in-memory malware campaigns confirmed in press reports, though ransomware use is unknown. Do: Patch immediately by upgrading affected BIG-IP systems to fixed releases per F5's security advisory (note that versions in End of Technical Support will not be fixed and should be upgraded or retired), prioritizing internet-facing virtual servers with APM access policies. Because observed attacks deploy a memory-resident PHP web shell via the PoisonedRefresh Linux rootkit, disk-only scans may miss compromise — inspect running processes and memory, and hunt for suspicious PHP or rootkit activity on BIG-IP APM devices. Federal agencies must follow the required action in CISA KEV/BOD 22-01: apply vendor mitigations or discontinue use of the product if mitigations are unavailable. | 9.3 | 2% | KEV |
| large≈14,000+ internet-exposed F5 BIG-IP devices (per public scan figures cited in press coverage) |