A Rootkit That Never Touches Disk
Researchers at Sophos have identified a Linux rootkit targeting F5 BIG-IP Access Policy Manager (APM) environments that intercepts PHP file loading and injects a fileless web shell directly into memory — never writing the malicious code to disk. Sophos has dubbed the implant "Poisoned Refresh" and is tracking the associated activity as cluster c05d5254.
The malware bears the hallmarks of a second-stage payload, likely deployed after initial access via CVE-2025-53521, a critical remote code execution flaw that F5 reclassified from a denial-of-service issue in March 2026. That bug allows unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server.
How the Rootkit Works
Poisoned Refresh is purpose-built for BIG-IP APM's specific software stack — Apache, libphp, APR module loading, and APM's webtop components — rather than generic Apache or PHP installations. It targets exactly three APM webtop scripts, and its mechanism is deliberately narrow:
- The rootkit hooks the module-loading functions used by Apache and waits for the PHP interpreter module to load.
- Once PHP is detected, it builds a modified in-memory copy of a targeted webtop script that contains the original content plus an embedded web shell.
- The web shell accepts specially formatted "magic" requests, decrypts their contents, executes them through PHP's
eval(), and returns an HTTP 201 response disguised as CSS content.
Because the on-disk PHP files are never altered, file-integrity monitoring and static scans of the webtop scripts come back clean — the malicious code exists only in the running Apache process's memory.
Stealth by Design
| Design Choice | Effect |
|---|---|
| Targets APM webtop scripts specifically | Less likely to trigger alerts than commonly-monitored web-facing PHP |
| In-memory patching only | PHP files on disk remain byte-for-byte unchanged |
| Response disguised as CSS with an HTTP 201 status | Blends into legitimate-looking web traffic |
| Encrypted command payloads | Defeats simple pattern-matching on request bodies |
Sophos assesses that this is not a broad, opportunistic Apache/PHP campaign — the level of environment-specific tailoring points to a targeted operation against BIG-IP APM deployments specifically.
Part of a Larger Attack Chain
Researchers believe the rootkit is one component of a staged operation. A related installer component appears to:
- Infect the HTTP server binary directly
- Preserve access through BIG-IP upgrade images, so the implant can survive routine version upgrades
- Modify SELinux settings to reduce friction for the payload
- Deploy the in-memory runtime payload described above
Because persistence can be embedded in the upgrade path itself, restarting the affected service is not a reliable recovery step — it may leave the underlying persistence mechanism intact.
No attribution to a known threat actor has been established. Sophos has not linked cluster c05d5254 to any previously tracked group.
Recommended Response
Organizations running BIG-IP APM should treat suspected compromise as a forensics matter, not a restart-and-move-on issue:
- Preserve volatile evidence first — process memory and running-process details — before making changes to a potentially compromised host.
- Investigate Apache workers for anomalous process-memory map reads, temporary write-and-execute changes around
libphp, unexpected local sockets, and child processes spawning Bash. - Follow F5's own remediation and compromise-assessment guidance for affected BIG-IP APM versions before applying generic Apache or PHP hardening steps — this implant was purpose-built for BIG-IP's specific stack.
- Confirm CVE-2025-53521 is patched and audit for signs of the initial-access exploitation this rootkit is believed to follow.
Why This Matters
Poisoned Refresh illustrates a broader trend in post-exploitation tradecraft: attackers with the resources to study a specific product's internals can build implants that leave essentially no static forensic trace, defeating file-integrity monitoring entirely. For edge devices like BIG-IP APM — which sit at the perimeter and often carry elevated trust — a memory-only, upgrade-surviving implant is a significantly harder incident to detect and fully evict than a conventional web shell dropped to disk.
References
- BleepingComputer — Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
- Sophos — Dissecting a PHP web server rootkit