Sophos Details F5 BIG-IP APM Rootkit That Injects a Fileless PHP Web Shell
Summary
Sophos analyzed a Linux rootkit found in F5 BIG-IP APM environments that hooks Apache and PHP to inject a fileless web shell. Researchers say it was likely deployed after exploitation of CVE-2025-53521; ESET calls the malware PoisonedRefresh.
Key points
- Sophos says the rootkit targets F5 BIG-IP APM systems running Apache and PHP and likely acts as a second-stage payload following exploitation of CVE-2025-53521.
- It intercepts Apache and PHP loading, then injects a web shell into PHP scripts’ in-memory copies without changing the files on disk.
- The implant uses RC4 obfuscation and hooks __libc_start_main and apr_dso_load, according to Sophos.
- The installer reportedly modifies SELinux settings and persists across BIG-IP upgrade images.
- A password-protected local UNIX socket can launch an interactive Bash shell without opening a TCP listening port; Sophos did not identify the component used to access it.
- Sophos recommends investigating unusual POST requests to targeted .php3 endpoints, HTTP 201 responses with a text/css content type, and suspicious Apache worker activity or creation of /run/bigtlog.pipe.
- Sophos identifies the rootkit’s malware as the same sample ESET calls PoisonedRefresh.
Article Details
- Attack Vectors
- The malware was likely deployed as a second-stage payload after exploitation of CVE-2025-53521 on F5 BIG-IP APM systems.
- An installer or propagation component infected the Apache /usr/sbin/httpd executable.
- The rootkit intercepts PHP loading and file operations to inject a web shell into memory, then executes specially formatted requests through PHP eval().
- The implant creates a password-protected local UNIX socket backdoor that can launch an interactive Bash shell.
- Defensive Notes
- Investigate unusual POST requests to targeted .php3 endpoints and responses combining HTTP 201 with a text/css content type.
- Look for Apache workers reading /proc/self/maps, changes to libphp memory protections, creation of /run/bigtlog.pipe, or launches of /bin/bash.
- Review modified SELinux configurations and persistence across BIG-IP upgrade images.
- Check for suspicious in-memory changes to scripts such as apm_css.php3, full_wt.php3, and webtop_popup_css.php3; the corresponding files on disk may remain unchanged.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bleepingcomputer[.]com | Publisher domain; not an attacker indicator. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe payload hides operational strings using RC4 obfuscation.T1055 · Process InjectionThe rootkit injects a PHP web shell into the in-memory copy of PHP scripts.T1059.004 · Unix ShellThe local UNIX socket backdoor can launch an interactive Bash shell.T1505.003 · Web ShellThe implant provides web-shell execution through specially formatted requests handled by PHP.T1543.002 · Systemd ServiceThe malware starts with Apache and uses an infected httpd executable to load the implant.T1564.001 · Hidden Files and DirectoriesThe web shell is injected into memory while the PHP files on disk remain unchanged.T1574.006 · Dynamic Linker HijackingThe implant intercepts __libc_start_main to gain execution before the host application's main() function.T1574.010 · Services File Permissions WeaknessThe rootkit hooks the Apache Portable Runtime module loader, apr_dso_load, to target PHP module loading.
CVE
Malware
Vendors
ESETThe malware appears to be a second-stage payload likely tied to CVE-2025-53521 and is also identified by ESET as PoisonedRefresh.F5 NetworksThe malware shows signs of being a second-stage payload that was likely deployed after exploiting CVE-2025-53521, a critical remote code execution (RCE) flaw that F5 Networks reclassified from a DoS problem in March.SophosSophos uncovered a Linux rootkit in F5 BIG-IP APM environments that intercepts PHP loading and injects a fileless web shell directly into memory, keeping malicious code off disk.