PoisonedRefresh Rootkit Injects Fileless PHP Web Shells Into F5 BIG-IP APM Server Memory via CVE-2025-53521

Summary

SophosLabs published a technical analysis on September 8 detailing a Linux rootkit that hooks Apache's runtime on F5 BIG-IP APM appliances and injects a PHP web shell into process memory without modifying any file on disk [1][2]. ESET had previously named the same malware PoisonedRefresh [3][4]. F5 tracks the related compromise activity as cluster c05d5254 and links it to exploitation of CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM that carries CVSS scores of 9.8 (v3.1) and 9.3 (v4.0) [5][6][7]. Sophos detects the implant as Linux/Agnt-IC [2][9].

No vendor has attributed this activity to a named threat actor [8]. The responsible group has not been confirmed by F5, Sophos, or ESET.

Background on CVE-2025-53521 and the Exposure Window

F5 originally disclosed CVE-2025-53521 on October 15, 2025, initially classifying it as a denial-of-service issue [6][11]. The vulnerability sits in the apmd process, the daemon responsible for processing live access policy traffic, and triggers when a BIG-IP APM access policy is configured on a virtual server [11]. F5 released patches as part of its October 2025 Quarterly Security Notification [11].

In March 2026, F5 updated advisory K000156741 after obtaining new information confirming the flaw could be exploited for unauthenticated remote code execution [6][12]. The CVSS score was raised to 9.8 [6]. CISA added it to the Known Exploited Vulnerabilities catalog on March 27, 2026, requiring federal civilian agencies to remediate within the standard deadline [5][6]. Ireland's NCSC and the UK NCSC both issued advisories urging immediate action, with the UK NCSC noting it was still working to understand impact on UK networks [7][1].

The reclassification matters operationally. Organizations that triaged the October 2025 advisory as a DoS risk may not have prioritized patching. Exploitation requires no credentials, no user interaction, and no elevated privileges [11][12]. A Metasploit module for CVE-2025-53521 is publicly available [5]. On March 31, 2026, Shadowserver fingerprinted over 14,000 exposed F5 BIG-IP APM instances globally [12]. As of early September 2026, roughly 795 internet-exposed endpoints remain vulnerable [2][4].

Affected BIG-IP APM branches: 15.1.0 through 15.1.10, 16.1.0 through 16.1.6, 17.1.0 through 17.1.2, and 17.5.0 through 17.5.1. Fixed releases: 15.1.10.8, 16.1.6.1, 17.1.3, and 17.5.1.3 [5][11]. F5 confirmed that customers who applied the October 2025 patches may have avoided compromise [11]. However, systems upgraded from a vulnerable to a fixed version may still harbor persistent malware, since PoisonedRefresh's fileless techniques and system-tampering tools can survive patching [12].

Two-Stage Infection Chain

PoisonedRefresh is a second-stage payload [1][3][4]. A separate installer component, associated with a binary named umount, handles initial infection [1][3]. The installer runs as root and performs several actions: it infects the Apache binary at /usr/sbin/httpd by prepending malicious code to the real binary, disables SELinux, and embeds itself inside BIG-IP upgrade images by infecting umount, httpd, and rc.local within those images [1][2]. This last step means the malware can propagate through BIG-IP installation media and survive device upgrades [1][12].

The two-stage structure indicates deliberate operational security design. The installer touches disk and performs system modifications; the second-stage implant operates entirely in memory. Separating these functions limits the forensic footprint available to incident responders who examine only the running implant.

How the Rootkit Executes Before Apache Starts

The implant intercepts __libc_start_main, the core Linux startup routine, gaining execution before Apache's own main() function runs [2][4]. This early position lets it install hooks before logging systems fully start and before some security tools can monitor the process [2].

The rootkit then hooks apr_dso_load, the Apache Portable Runtime function that loads shared libraries, and waits for Apache to load the PHP module (libphp) [2][3]. Once PHP loads, the malware checks /proc/self/maps to find where libphp sits in memory [2]. It temporarily changes memory protections on the relevant pages, injects its hooks into PHP's file-handling functions (open, close, and mmap), and restores the original protections afterward [2][5].

The rootkit also uses Apache's apr_time_now function as a delayed trigger, waiting until the server has fully started before activating the socket worker [2][9].

In-Memory Web Shell Injection

The malware targets three specific PHP files used by the BIG-IP APM webtop environment:

• apm_css.php3
• full_wt.php3
• webtop_popup_css.php3 [1][2][10]

F5 named all three in March in its published indicators of compromise for c05d5254, noting at the time that their presence alone does not indicate compromise and that the web shells "have been observed to work in memory only" [1]. The Sophos analysis explains how both of F5's statements are consistent: the files on disk remain legitimate, but when PHP maps one of these files into memory via mmap(), the rootkit intercepts the call and returns a modified view containing the original script content preceded by the embedded web shell [2][5][8].

A file-integrity monitor or forensic analyst examining the filesystem sees clean, unmodified PHP. The running Apache process executes the attacker's code [8].

Web Shell Command Protocol

The injected web shell reads raw data from php://input and looks for the prefix BSOHAzPB [2]. It then decrypts the remaining content using a stream cipher with the key wSLjN1beuR and executes the result via PHP's eval() function [2][5]. Responses use HTTP status 201 with content-type text/css; charset=utf-8, making malicious command traffic blend into apparently normal CSS-related requests on a BIG-IP APM device [2][9].

According to CybelAngel's analysis, the RC4 key appears to be unique to each sample, which means a defender who identifies a compromised device cannot interact with the web shell without the specific key embedded in that sample [5]. CybelAngel described this as an almost NOBUS ("Nobody But Us") design [5].

Local Socket Backdoor

PoisonedRefresh provides a second access path through a UNIX domain socket at /run/bigtlog.pipe [1][2]. After a short authentication step using the token Kzwd6jM5, the socket connects to /bin/bash for an interactive shell without opening a TCP listening port [2][4]. This means the backdoor will not appear in network scans or standard port enumeration [4][5].

Sophos found no code in the analyzed sample that connects to the socket externally, so the relationship between the web shell component and the socket remains unclear [1][3]. The socket is not directly internet-exposed; an attacker would need another foothold on the host or local network to reach it [4].

F5 also listed /run/bigstart.ltm alongside bigtlog.pipe as a related indicator [1].

Indicators of Compromise

Additional operational strings found in the implant:

MITRE ATT&CK Mapping

Detection and Hunting

Traditional file-integrity monitoring and antivirus scanning are blind to this implant by design. The on-disk PHP files remain legitimate. Detection must focus on runtime behavior and process-level indicators.

HTTP traffic analysis. Look for POST requests to .php3 endpoints on BIG-IP APM webtop paths, particularly apm_css.php3, full_wt.php3, and webtop_popup_css.php3. Responses with HTTP status 201 and content-type text/css from these endpoints are abnormal and warrant investigation [2][9].

Process and memory inspection. Examine Apache worker processes for unexpected memory maps. Check /proc/<pid>/maps for anomalous memory regions near libphp. Look for temporary changes to memory protections (readable-writable-executable segments) around the libphp address range [2][8].

Local socket detection. Search for the existence of /run/bigtlog.pipe and /run/bigstart.ltm. Any UNIX domain socket at these paths is a strong indicator [1]. Also look for Apache child processes spawning /bin/bash, which should not occur during normal BIG-IP APM operation [8].

Binary integrity. Compare /usr/sbin/httpd and /usr/bin/umount against known-good versions from F5. Check file sizes, timestamps, and cryptographic hashes against F5's published baselines [1].

SELinux configuration. Audit SELinux status and configuration files. The installer disables SELinux; any unexpected change from enforcing to permissive or disabled mode should trigger investigation [1][2].

Sigma Rule (web shell HTTP indicators):

title: PoisonedRefresh Web Shell HTTP Response Indicators on BIG-IP APM
id: a3c7e1d0-8f2b-4e91-b6a4-0d1f3c5e7a92
status: experimental
author: RedSheepSec
date: 2026/09/10
description: Detects HTTP 201 responses with text/css content-type from BIG-IP APM webtop PHP3 endpoints, which may indicate PoisonedRefresh web shell activity
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs-uri-stem|endswith:
      - 'apm_css.php3'
      - 'full_wt.php3'
      - 'webtop_popup_css.php3'
  selection_response:
    sc-status: 201
    sc-content-type|contains: 'text/css'
  condition: selection_uri and selection_response
falsepositives:
  - Legitimate BIG-IP APM webtop CSS loading (unlikely to produce HTTP 201)
level: high
tags:
  - attack.t1071.001
  - attack.t1001.003

qkview reports. F5's qkview diagnostic utility captures system state information. Defenders should generate and review qkview reports even after patching, since the malware can survive upgrades [10][12].

Analysis

PoisonedRefresh represents a significant capability investment. The implant was built specifically for F5 BIG-IP APM environments. Sophos noted the malware "targets deployments featuring Apache, libphp, APR module loading, BIG-IP APM webtop components, and BIG-IP upgrade workflows, suggesting it was developed for specific environments" [2][3]. This is not a generic Linux rootkit repurposed for network appliances. The selection of three particular .php3 files, the per-sample RC4 keys, the NOBUS-like design, and the upgrade-image persistence all point to a developer with detailed knowledge of BIG-IP APM internals.

The vulnerability timeline created a window of opportunity. Between October 2025 (initial DoS disclosure) and March 2026 (RCE reclassification), organizations that applied the patch based on a DoS risk assessment were protected. Those that deprioritized a DoS-classified flaw were exposed to RCE exploitation for roughly five months. Ireland's NCSC noted that exploitation may have predated the October 2025 disclosure itself [1].

The exposure numbers tell a clear story about patch adoption. Shadowserver counted over 14,000 exposed instances on March 31, 2026 [12]. Six months later, approximately 795 remain [2][4]. That reduction shows most organizations acted, but the remaining 795 are running internet-exposed appliances vulnerable to a flaw with public exploit code and confirmed in-the-wild exploitation.

References

[1] https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html

[2] https://securityaffairs.com/198746/malware/poisonedrefresh-a-fileless-linux-rootkit-that-injects-php-web-shells-into-f5-big-ip-apm-server-memory.html

[3] https://www.helpnetsecurity.com/2026/09/09/f5-big-ip-apm-rootkit-hides-web-shell-in-memory/

[4] https://www.bleepingcomputer.com/news/security/hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit/

[5] https://cybelangel.com/blog/poisonedrefresh-is-the-f5-rootkit-your-file-scanner-wont-find/

[6] https://www.infosecurity-magazine.com/news/ncsc-urges-immediate-patching-f5/

[7] https://www.ncsc.gov.uk/news/vulnerability-affecting-f5-big-ip-apm

[8] https://cybersecuritynews.com/linux-rootkit/

[9] https://gbhackers.com/poisonedrefresh-malware/

[10] https://www.hendryadrian.com/f5-big-ip-apm-malware-injects-a-php-web-shell-into-memory-evading-disk-scans/

[11] https://www.cycognito.com/blog/emerging-threat-f5-big-ip-access-policy-manager-remote-code-execution-cve-2025-53521/

[12] https://cybersecuritytimes.com/14000-f5-big-ip-apm-exposed-rce/