← News
/DISPATCH · 2026-09-09

F5 BIG-IP APM Hit by PoisonedRefresh Rootkit: Fileless In-Memory WebShell Bypasses File Detection

Sophos X-Ops disclosed a Linux rootkit against F5 BIG-IP APM: CVE-2025-53521 used to implant components that persist across upgrades; WebShell injected into memory with no files on disk. 795 devices still exposed.

Sophos X-Ops recently disclosed a Linux rootkit targeting F5 BIG-IP APM appliances. After initial access via unauthenticated RCE CVE-2025-53521, the deployed malware injects a WebShell directly into memory; disk files stay unchanged, so conventional FIM and web-directory scans fail completely. ShadowServer tracking shows 795 vulnerable BIG-IP APM endpoints still exposed on the public internet as of September 8.

Incident Overview

The malware was independently analyzed by Sophos and ESET; ESET named it PoisonedRefresh. Entry point CVE-2025-53521 is an unauthenticated RCE in BIG-IP APM, CVSS 9.8, triggered when an APM access policy is configured on a virtual server. F5 confirmed in-the-wild exploitation. F5 initially classified it as DoS, then reclassified it as RCE in March, amplifying the risk.

Technical Details

Stage-2 payload is a statically linked ELF binary that completely skips the standard Linux startup path: the entry point goes straight into a custom loader, reopens /proc/self/exe and wraps __libc_start_main so malicious code runs before the host program's main(); critical strings stored RC4-encrypted.

It then hooks the Apache module-load function apr_dso_load, after libphp loads locates the module in memory, relaxes page protection, and patches PHP's open, close, mmap, and __fxstat. When BIG-IP APM webtop scripts apm_css.php3, full_wt.php3, webtop_popup_css.php3 are mapped into memory, the WebShell is prepended—disk files are untouched.

`WebShell trigger: request body starts with magic number BSOHAzPB
Execution flow: php://input reads the request → decrypt → eval()
Response camouflage: HTTP 201 + Content-Type: text/css`

Besides the HTTP entry, the malware also creates a password-protected local UNIX domain socket and can spawn interactive /bin/bash without listening on any TCP port. A separate installer infects /usr/sbin/httpd, modifies SELinux config, and implements persistence across BIG-IP version upgrades via the upgrade-image workflow.

Impact Assessment

Official fixed versions: 17.5.1.3, 17.1.3, 16.1.6.1, 15.1.10.8 and later on the same branches. F5 provided no vulnerability-level mitigation. Emphasize: upgrade only closes the entry; already-implanted systems remain compromised after upgrade. Unchanged login-page files do not prove the device is clean.

Hunt and Remediation

References