A sophisticated Linux rootkit has been discovered targeting F5 BIG-IP APM devices, allowing hackers to intercept PHP file loading and inject a fileless web shell directly into memory. This means that malicious code is executed without being written to disk, making it harder to detect.
The malware, identified as “PoisonedRefresh” by ESET and analyzed in detail by Sophos researchers, shows signs of being a second-stage payload deployed after exploiting CVE-2025-53521, a critical remote code execution (RCE) flaw that was previously downgraded from a Denial of Service (DoS) problem. This vulnerability is particularly concerning as it allows attackers to gain access to F5 BIG-IP APM systems with valid credentials.
The rootkit achieves its goal by intercepting PHP file operations and modifying them in memory, making it difficult for security software to detect the injected web shell. The scripts targeted by the malware are likely chosen because they are present in BIG-IP APM webtop environments and are less likely to trigger security alerts. Moreover, the PHP files on disk remain unchanged, significantly reducing the detection surface.
Once deployed, the rootkit creates a password-protected local communication socket that can launch an interactive Bash shell without opening a TCP listening port. This means that attackers would need another foothold on the device to access it. However, Sophos did not identify the component used to interact with this socket.
The security firm shared a set of signals for malicious activity linked to the malware, which include Apache workers reading /proc/self/maps, changing libphp memory protections, creating /run/bigtlog.pipe, or launching /bin/bash. Defenders are advised to investigate unusual POST requests to the targeted .php3 endpoints and PHP responses combining HTTP 201 with a text/css content type.
It’s worth noting that the ShadowServer Foundation reports that 795 endpoints were exposed online yesterday, and once attackers have valid credentials, only 37% of their actions are blocked. This highlights the importance of robust prevention measures and the need to consider not just initial access but also the subsequent activities of attackers.
In conclusion, the discovery of this sophisticated Linux rootkit targeting F5 BIG-IP APM devices is a stark reminder of the ongoing threat landscape. To mitigate this risk, it’s essential for defenders to remain vigilant and monitor their systems closely for signs of malicious activity. This includes keeping software up-to-date, implementing robust access controls, and monitoring network traffic for suspicious patterns. By taking these proactive steps, organizations can reduce the risk of falling victim to this type of attack and protect their sensitive data from unauthorized access.
Source: Bleeping Computer — 2026-09-08