Hackers Deploy Linux Rootkit on F5 BIG-IP APM Devices Hiding Web Shell in Memory

Severity
Medium

Detail

Sophos researchers identified a Linux rootkit targeting compromised F5 BIG-IP APM devices that hide a web shell entirely in memory instead of writing the final web shell content to disk. F5 BIG-IP APM is used to enforce access policies for applications, APIs, and data, with deployments commonly found in enterprise, financial, government and public sector environments.

The malware provides on-demand server-side code execution similar to a traditional web shell but uses Linux- and Apache-specific techniques. The malware targets environments containing Apache, PHP, Apache Portable Runtime (APR) module loading, BIG-IP APM webtop components and BIG-IP upgrade workflows.

F5 has linked related activity to CVE-2025-53521, an unauthenticated remote code execution vulnerability in BIG-IP APM that has been exploited in the wild. Sophos identified the analyzed malware as a second-stage payload. ESET had previously analyzed the same malware and named it PoisonedRefresh.

How?

The infection involves a staged architecture. During analysis of a related sample named umount, Sophos identified an installer component that infects the Apache binary at:

/usr/sbin/httpd

The installer also persists across BIG-IP upgrade images, modifies SELinux configurations, and deploys the second-stage payload. The second-stage implant hides operational strings using RC4 and gains execution before the host application’s main() function by intercepting __libc_start_main. It then targets Apache’s PHP module by hooking the APR module loader function apr_dso_load.

After Apache loads PHP, the implant intercepts PHP file operations and modifies files in memory to inject a PHP web shell into legitimate scripts.

The targeted files include:

• apm_css.php3
• full_wt.php3
• webtop_popup_css.php3

These files were selected because they are common within BIG-IP APM webtop environments and may attract less attention. When PHP opens one of the targeted files, the implant records the file descriptor. When the file is subsequently memory-mapped, the implant creates a modified in-memory representation containing both the web shell and the original script content. As a result, the files stored on disk remain unchanged while the web shell exists only within the modified memory representation used during execution.

The malware also creates a Unix domain socket at:

/run/bigtlog.pipe

After a token check, a connection to the socket is passed directly to:

/bin/bash

This provides an attacker with an interactive shell. Because the socket is local rather than a network listener, it does not appear as an open TCP listening port. Researchers did not identify code that would allow external attackers to directly reach the socket, so the relationship between the web shell and the Unix socket remains unclear.

Impact

The rootkit allows attackers to achieve server-side code execution while avoiding the need to store the final web shell on disk. Because the malicious content is created in memory when targeted PHP files are accessed, the content observed by Apache and PHP can differ from the content stored on the filesystem.

This can make traditional file-based inspection less effective and may cause responders who focus exclusively on filesystem evidence to overlook important evidence. The malware also provides an interactive shell through the /run/bigtlog.pipe Unix domain socket.

Sophos identified several signals defenders can investigate on affected Apache servers, including requests involving the targeted .php3 files, PHP endpoints returning HTTP 201 while claiming to serve CSS content, and Apache worker processes that read /proc/self/maps and subsequently modify memory permissions.

Recommendation

• Block .php3 execution where it is not required, while BIG-IP APM administrators should follow F5’s guidance before making such changes.
• Restrict ptrace access to reduce other methods of process inspection or manipulation, while noting that this may not prevent the implant’s in-process behavior.

Conclusion

The campaign uses a staged Linux rootkit architecture to deliver web-shell functionality while keeping the final malicious content out of the filesystem. By intercepting Apache and PHP operations, the implant modifies targeted PHP files in memory so that the content executed by Apache and PHP differs from what is stored on disk. Sophos highlighted that this technique can allow critical evidence to be missed when incident responders rely exclusively on traditional filesystem inspection.

Source

https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit
https://www.helpnetsecurity.com/2026/09/09/f5-big-ip-apm-rootkit-hides-web-shell-in-memory/