Cybersecurity Threats Hit F5 BIG-IP APM Devices with Sophisticated Linux Rootkit
A highly sophisticated malware has been found targeting devices in F5 BIG-IP Application Delivery Networking (ADN) environments, allowing hackers to intercept and inject malicious code directly into memory. The Linux rootkit, identified as “PoisonedRefresh” by ESET, is capable of bypassing traditional detection methods by avoiding the need to write malicious code to disk.
The malware appears to be a second-stage payload that was deployed after exploiting a critical remote code execution (RCE) flaw in F5 BIG-IP APM systems. This vulnerability, known as CVE-2025-53521, was previously reclassified from a denial-of-service (DoS) issue in March by F5 Networks. Researchers at Sophos analyzed the malware and found that it uses “deeper Linux- and Apache-specific tradecraft” to achieve its goals.
The rootkit starts by infecting the Apache executable used on BIG-IP APM systems, modifying SELinux configurations, and achieving persistence across upgrade images. It then intercepts PHP file operations and injects a web shell into memory, allowing hackers to execute arbitrary code on the system. The malware targets specific scripts that are present in BIG-IP APM webtop environments, as they are less likely to trigger security alerts.
One of the most concerning aspects of this threat is its ability to evade detection by traditional security measures. Since the malicious code is injected directly into memory and not written to disk, it significantly reduces the detection surface. Furthermore, the malware uses a password-protected local communication socket to launch an interactive Bash shell without opening a TCP listening port.
Sophos researchers have identified a set of signals that can indicate malicious activity linked to this malware, including Apache workers reading /proc/self/maps, changing libphp memory protections, creating /run/bigtlog.pipe, or launching /bin/bash. Defenders are advised to investigate unusual POST requests to targeted .php3 endpoints and PHP responses combining HTTP 201 with a text/css content type.
The ShadowServer Foundation reports that over 795 F5 BIG-IP APM systems were exposed online yesterday, highlighting the need for organizations to take immediate action to protect themselves against this threat. While prevention scores can hide what happens after initial access, it’s essential to note that once attackers have valid credentials, traditional prevention measures drop sharply.
To mitigate this threat, organizations should focus on implementing robust security controls and monitoring their systems closely for suspicious activity. This includes keeping software up-to-date, enforcing strict access controls, and regularly reviewing logs for signs of unauthorized access.
Source: Bleeping Computer — 2026-09-08