Sophos Details F5 BIG-IP Malware That Injects a PHP Web Shell Into Memory

Summary

Sophos explains how c05d5254 modifies Apache and PHP loading to inject a web shell into memory on F5 BIG-IP APM appliances, evading disk scans. It recommends checking memory, files, logs and integrity reports even after patching.

Key points

The web shell is injected into in-memory copies of apm_css.php3, full_wt.php3 or webtop_popup_css.php3, so those files may appear clean on disk.
The analyzed sample hooks Apache’s apr_dso_load function and alters how libphp opens and maps the scripts.
An installer infects /usr/sbin/httpd; Sophos said the added code’s size strongly suggests the installer places the payload there.
The malware can also open /run/bigtlog.pipe and connect it to /bin/bash after checking a fixed token; Sophos found no evidence showing how an attacker reaches this socket.
F5 linked c05d5254 activity to exploitation of CVE-2025-53521, which F5 reclassified as remote code execution and said was exploited.
Sophos recommends investigating memory, files, processes and logs, running F5’s sys-eicheck, and collecting a qkview report; patching does not establish whether an appliance was previously compromised.
The attacker and exploitation start date remain unknown, and the article says advisories do not establish whether upgrading removes installed malware.

Article Details

Attack Vectors: F5 linked the c05d5254 activity to BIG-IP APM appliances affected by CVE-2025-53521. The flaw was reclassified as remote code execution and reported as exploited; exploitation requires no login.
A separate installer infects the Apache httpd binary. After Apache loads libphp, the malware alters how PHP opens and maps files, injecting a web shell into the in-memory copies of three BIG-IP APM PHP scripts.
The web shell processes marked, encrypted HTTP request bodies and executes their contents. The malware also creates a local socket that can connect to /bin/bash after a fixed token is provided.
ESET reported that the installer is intended to run as root, disables SELinux, and infects components inside BIG-IP install images.
Defensive Notes: Patching does not establish whether an appliance was compromised beforehand. Investigate for compromise regardless of when the system was updated.
Run F5's sys-eicheck integrity check and compare /usr/bin/umount and /usr/sbin/httpd with known-good copies appropriate to the appliance release and hotfix level.
Investigate the presence of /run/bigtlog.pipe or /run/bigstart.ltm; relevant audit-log activity; HTTP 201 responses with a CSS content type; and Apache worker behavior involving /proc/self/maps, memory permissions around libphp, sockets under /run, or /bin/bash.
Treat changes to apm_css.php3, full_wt.php3, and webtop_popup_css.php3 as leads rather than proof of compromise: the web shell may exist only in memory.
Collect a qkview report for F5 review and compare in-memory modules with their on-disk copies. If a full investigation is not possible, the UK NCSC advises isolating and rebuilding the appliance, which may cause an outage.