Hackers Deploy Linux Rootkit to Breach F5 BIG-IP APM Devices, Inject Fileless Web Shell

Second-stage payload exploits critical RCE flaw CVE-2025-53521, evades detection by modifying memory instead of disk

edit

By LineZotpaper

Published9 September 2026

Read Time2 min

A sophisticated Linux rootkit targeting F5 BIG-IP APM devices has been observed deploying a fileless web shell directly into memory, according to security researchers. The malware, which Sophos and ESET have analyzed, is believed to be a second-stage payload delivered after exploiting CVE-2025-53521, a critical remote code execution vulnerability that F5 reclassified from a denial-of-service issue in March.

The rootkit, identified by ESET as 'PoisonedRefresh', intercepts PHP file loading on compromised BIG-IP APM systems and injects a web shell into memory without writing malicious code to disk. Sophos researchers noted that while the malware enables on-demand server-side code execution typical of webshells, it achieves this through deeper Linux- and Apache-specific tradecraft.

The implant was deployed by a separate installer component that had infected the Apache /usr/sbin/httpd executable used on BIG-IP APM systems. The malicious installer also modified SELinux configurations and achieved persistence across BIG-IP upgrade images, making it difficult to remove.

Once active, the rootkit hides key operational strings using RC4 encryption, gains execution before the host application's main() function by intercepting __libc_start_main, and hooks the Apache Portable Runtime module loader (apr_dso_load) to target Apache's PHP module. It then injects a PHP web shell into memory, modifying legitimate scripts like apm_css.php3, full_wt.php3, and webtop_popup_css.php3 without altering the files on disk, significantly reducing the detection surface.

The injected webshell accepts specially formatted requests, decrypts their contents, executes them through PHP's eval() function, and returns an HTTP 201 response disguised as CSS content. A protection mechanism delays the creation of a local backdoor when Apache starts, reducing the risk of service disruption and detection. The rootkit also creates a password-protected local communication socket that can launch an interactive Bash shell without opening a TCP listening port, though the socket is not directly exposed to the internet.

Analysis

Why This Matters

Organizations using F5 BIG-IP for access management are at risk; the rootkit can provide persistent, stealthy access to network perimeters.
The fileless technique makes detection by traditional antivirus and file integrity monitoring difficult, emphasizing the need for memory-level security monitoring.
The evolution of malware targeting network appliances highlights the growing sophistication of attacks against critical infrastructure components.

Background

CVE-2025-53521 was originally classified as a denial-of-service vulnerability by F5 but was later reclassified as a critical remote code execution flaw. In March, F5 urged customers to patch immediately as attackers began exploiting the flaw. The rootkit analyzed by Sophos and ESET appears to be a second-stage payload deployed after successful exploitation, indicating a targeted campaign.

Key Perspectives

Sophos Researchers: Highlight the deep Linux- and Apache-specific techniques used, including hooking of APR module loader and RC4 encryption of strings, showing advanced tradecraft. ESET: Tracks the malware as 'PoisonedRefresh' and has shared technical indicators. F5 Networks: Has reclassified the vulnerability to critical and urged patching, but the rootkit's persistence across upgrade images suggests removal may require more than patching.

What to Watch

Further indicators of compromise from Sophos and ESET as they continue to analyze the rootkit.
Additional exploitation attempts of CVE-2025-53521, potentially leading to further deployments of this or similar malware.
F5 advisory updates and potential emergency patches or scanning tools for affected devices.

Sources

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit — BleepingComputer