F5 BIG-IP appliances are running web shells that no disk scanner will ever find. Researchers at Sophos and ESET describe PoisonedRefresh, a fileless Linux rootkit that injects PHP backdoors into the memory of Access Policy Manager servers, and SophosLabs published its deep dive on September 8.
Entry comes through CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM that F5 first downplayed as a denial-of-service bug before confirming code execution. Shadowserver found 795 internet-exposed hosts at risk when details emerged.
The two-stage design explains the invisibility. A first stage packed into a tampered umount binary plants itself in /usr/sbin/httpd, rewrites SELinux policy and burrows into BIG-IP upgrade images so it survives updates. The second stage is a self-loading ELF that intercepts libc_start_main to win the race against Apache startup, hooks the runtime’s module loader and waits for PHP. When Apache maps one of three webtop scripts into memory, the malware swaps in a poisoned view: original content with a shell bolted to the front, while the bytes on disk never change. A Unix socket at /run/bigtlog.pipe then hands over an interactive bash session with no listening TCP port, and RC4 keeps key strings hidden from static analysis.
F5 ties the intrusions to CVE-2025-53521 exposure and tells customers to run its remediation and compromise-assessment guidance before generic hardening. Sophos’s message to defenders: hunt in memory and watch runtime behavior, because file-based detection will not see this one.
