Security researchers have discovered a Linux rootkit targeting F5 BIG-IP Access Policy Manager environments.
The malware injects a fileless web shell directly into system memory. Therefore, it can give attackers remote access without writing the malicious PHP code to disk.
Rootkit may follow exploitation of critical flaw
Researchers believe attackers deploy the malware as a second-stage payload after gaining initial access.
The intrusion may involve CVE-2025-53521, a critical remote code execution vulnerability in F5 BIG-IP systems. F5 initially classified the issue as a denial-of-service flaw. However, the company raised its severity in March after confirming a greater security impact.
Sophos analysed a sample of the F5 Linux rootkit. ESET also examined the same malware and named it PoisonedRefresh.
According to Sophos, a separate installer or propagation component likely deployed the rootkit. That component infected the Apache /usr/sbin/httpd executable used by BIG-IP APM.
The installer also changed SELinux configurations. In addition, it established persistence that could survive BIG-IP software upgrades.
Malware injects a web shell into memory
The rootkit loads before the main Apache application starts. It then targets Apache’s PHP module and intercepts the process used to load software components.
Once active, the malware monitors PHP file operations. It modifies copies of legitimate scripts in memory and inserts a web shell into them.
However, the original PHP files remain unchanged on disk. This technique makes traditional file scanning less effective.
The attackers selected scripts commonly found in BIG-IP APM webtop environments. Because those files normally exist on the system, their use may attract less attention.
The injected web shell waits for specially formatted requests. It decrypts the supplied content, executes it through PHP’s eval() function, and returns the result.
To disguise the response, the malware uses an HTTP 201 status and presents the output as CSS content.
Rootkit delays activation to avoid detection
The F5 Linux rootkit includes several techniques designed to reduce disruption and conceal its activity.
When Apache starts, the malware does not immediately create its local backdoor. Instead, it waits until the process begins making routine time-related system calls.
At that point, it launches and detaches a worker thread. This delayed behaviour helps the implant blend into normal Apache activity.
Moreover, the timing reduces the risk of destabilising the service. A crash during startup could alert administrators to the compromise.
The malware also hides important operational strings with RC4 encryption. This makes static analysis more difficult.
Local socket provides access to a Bash shell
In addition to the web shell, the rootkit creates a password-protected Unix communication socket.
Attackers can use this socket to launch an interactive Bash shell. However, it does not open a traditional TCP listening port.
Because the socket remains local, it is not directly reachable from the internet. An attacker would need another foothold on the compromised device to access it.
Sophos did not identify the separate component used to communicate with the local backdoor.
Indicators can reveal compromised devices
Security teams can search for several signs associated with the rootkit.
Suspicious behaviour includes Apache worker processes reading /proc/self/maps or changing memory protections for libphp. Administrators should also investigate the creation of /run/bigtlog.pipe.
An Apache worker launching /bin/bash is another serious warning sign.
Defenders should also monitor unusual POST requests sent to affected .php3 endpoints. Responses that combine an HTTP 201 status with a text/css content type may indicate web-shell activity.
Since the malicious PHP code exists only in memory, checking files on disk may not reveal the compromise. Behavioural monitoring and memory analysis are therefore particularly important.
Hundreds of vulnerable endpoints remain online
The Shadowserver Foundation reported that 795 F5 BIG-IP APM endpoints vulnerable to CVE-2025-53521 remained exposed online.
Organizations should install available security updates and investigate systems that were accessible before patching. Simply applying an update may not remove malware from a device that attackers already compromised.
Security teams should review Apache activity, inspect system memory, and search for the known indicators. They should also rebuild affected appliances from trusted sources if they find evidence of compromise.
0 responses to “Hackers Breach F5 BIG-IP Devices to Deploy Linux Rootkit”