Sophos Finds F5 BIG-IP APM Rootkit That Hides Web Shell in Memory
Summary
Sophos analyzed a staged rootkit on compromised F5 BIG-IP APM devices that hides a web shell in memory by intercepting Apache and PHP operations. F5 linked related activity to exploitation of CVE-2025-53521.
Key points
- The implant delivers web-shell-like code execution by altering targeted PHP files in memory; their on-disk contents remain unchanged.
- It hooks __libc_start_main and Apache’s APR module loader, then intercepts PHP file operations and memory mapping.
- The malware targets Apache, libphp, APR, BIG-IP APM webtop components, and upgrade workflows.
- A separate installer reportedly infects /usr/sbin/httpd, persists across BIG-IP upgrade images, modifies SELinux configurations, and deploys the second-stage payload.
- The implant also creates a Unix domain socket at /run/bigtlog.pipe that can hand connections to /bin/bash; researchers found no code showing how an attacker could reach it externally.
- F5 linked related activity to in-the-wild exploitation of CVE-2025-53521. ESET identified the same malware as PoisonedRefresh.
- Sophos recommends checking for suspicious requests to named .php3 files and unusual Apache/PHP behavior; it advises following F5 guidance before blocking .php3 execution.
Article Details
- Attack Vectors
- F5 linked the activity to in-the-wild exploitation of CVE-2025-53521, an unauthenticated remote code execution vulnerability in BIG-IP APM.
- A related installer component reportedly infects the Apache binary at /usr/sbin/httpd, modifies SELinux configurations, and deploys a second-stage payload.
- The second-stage payload hooks Apache and PHP-related functions and rewrites targeted PHP files in memory to provide web-shell-like access.
- The implant creates a Unix domain socket at /run/bigtlog.pipe that, after a token check, hands connections to /bin/bash; researchers found no code showing how an attacker could reach the socket externally.
- Defensive Notes
- Check for requests to apm_css.php3, full_wt.php3, and webtop_popup_css.php3, and for PHP endpoints returning HTTP 201 while claiming to serve CSS.
- Look for Apache worker processes reading /proc/self/maps and then changing memory permissions.
- Consider blocking .php3 execution where it is not needed, following F5 guidance for BIG-IP APM systems.
- Sophos recommends restricting ptrace access, while noting this may not stop the implant's in-process behavior.
- Do not rely exclusively on filesystem inspection: the web shell is assembled in a modified in-memory view while the on-disk files remain unchanged.
MITRE ATT&CK
T1014 · RootkitThe article describes the implant as a Linux rootkit that hides web-shell content in memory and alters how Apache and PHP see targeted files.T1027 · Obfuscated Files or InformationThe second-stage sample uses RC4 to hide key operational strings.T1190 · Exploit Public-Facing ApplicationF5 linked the activity to exploitation of CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM.T1505.003 · Web ShellThe implant provides web-shell-like server-side code execution by inserting a PHP web shell into targeted scripts in memory.
CVE
Malware
Vendors
Products
ApacheThe campaign is linked to exploited F5 BIG-IP APM activity, including CVE-2025-53521, and uses staged malware with deeper Apache and PHP interception techniques.BIG-IP APMSophos found a rootkit on compromised F5 BIG-IP APM devices that hides a web shell in memory instead of writing it to disk, making it harder for file-based security tools to detect.PHPThe campaign is linked to exploited F5 BIG-IP APM activity, including CVE-2025-53521, and uses staged malware with deeper Apache and PHP interception techniques.