{"id":1485,"date":"2026-09-09T12:03:45","date_gmt":"2026-09-09T06:33:45","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1485"},"modified":"2026-09-10T09:14:38","modified_gmt":"2026-09-10T03:44:38","slug":"f5-big-ip-apm-rootkit","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/f5-big-ip-apm-rootkit\/","title":{"rendered":"F5 BIG-IP APM Rootkit: How PoisonedRefresh Hides a Web Shell in Memory"},"content":{"rendered":"

Attackers targeting F5 BIG-IP APM environments have deployed a Linux rootkit that injects a PHP web shell directly into process memory. The technique leaves the targeted PHP files unchanged on disk, making conventional file-based web shell checks less effective.<\/p>\n

Sophos analyzed the implant, while ESET independently tracks the malware as PoisonedRefresh. The malware appears to be a second-stage payload associated with compromised BIG-IP APM environments. Related activity is associated with CVE-2025-53521, an actively exploited BIG-IP APM remote code execution vulnerability. However, the available research does not establish CVE-2025-53521 as the initial-access vector for every analyzed PoisonedRefresh infection.<\/p>\n

That distinction matters. CVE-2025-53521 can result in unauthenticated remote code execution, while PoisonedRefresh appears to be a second-stage payload likely deployed after exploitation. However, the available research does not establish CVE-2025-53521 as the deployment path for every PoisonedRefresh infection or document alternative initial-access vectors.<\/p>\n

F5 BIG-IP APM Rootkit at a Glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Detail<\/span><\/b>\u00a0<\/span><\/td>\nInformation<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
Vulnerability<\/span>\u00a0<\/span><\/td>\nCVE-2025-53521<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Affected product<\/span>\u00a0<\/span><\/td>\nF5 BIG-IP Access Policy Manager<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Vulnerability type<\/span>\u00a0<\/span><\/td>\nStack-based buffer overflow; potential impact: remote code execution<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVSS<\/span>\u00a0<\/span><\/td>\n9.8 CVSS v3.1 \/ 9.3 CVSS v4.0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Exploitation status<\/span>\u00a0<\/span><\/td>\nActive exploitation confirmed<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Malware name<\/span>\u00a0<\/span><\/td>\nPoisonedRefresh\u00a0by ESET; Linux\/Agnt-IC detection by Sophos<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Rootkit target<\/span>\u00a0<\/span><\/td>\nBIG-IP APM environments using Apache and PHP components<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Distinctive behavior<\/span>\u00a0<\/span><\/td>\nIn-memory PHP web shell injection<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CISA KEV<\/span>\u00a0<\/span><\/td>\nAdded March 27, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Fixed releases for affected branches<\/span>\u00a0<\/span><\/td>\n15.1.10.8, 16.1.6.1, 17.1.3, 17.5.1.3, and 21.0.0.<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

CVE-2025-53521 affects BIG-IP APM when an access policy is configured on a virtual server. F5 initially described the issue differently before later confirming that specific malicious traffic could result in unauthenticated RCE.<\/p>\n

How PoisonedRefresh Makes Clean PHP Files Execute Malicious Code<\/h2>\n

The distinctive part of PoisonedRefresh is not simply that it provides a web shell. It changes what Apache’s PHP runtime sees when selected files are loaded.<\/p>\n

Sophos found that the second-stage implant hooks __libc_start_main<\/code>. It also hooks the Apache Portable Runtime function apr_dso_load<\/code> to detect when Apache loads PHP components as part of its PHP-injection mechanism.<\/p>\n

From there, the malware manipulates memory behavior inside libphp<\/code>. This lets it alter the in-memory representation of selected BIG-IP APM webtop scripts, including:<\/p>\n