Fileless Rootkit Targets F5 BIG-IP APM Webtop Servers
Researchers at Sophos have identified a Linux rootkit — named PoisonedRefresh by ESET — actively deployed against F5 BIG-IP Access Policy Manager (APM) webtop environments. The implant intercepts PHP file loading and injects a fileless web shell directly into memory, leaving the PHP files on disk completely unchanged.
How the Rootkit Works
PoisonedRefresh targets three specific APM webtop scripts, chosen because they're less likely to draw scrutiny during routine file-integrity checks:
- When PHP maps one of the target scripts into memory, the rootkit builds a modified copy in memory containing the original code plus an embedded web shell
- The on-disk file is never altered, so integrity checks that only hash web-root files will not detect the compromise
- The injected shell accepts specially crafted "magic" requests, decrypts their contents, executes them through PHP's
eval(), and responds with an HTTP 201 disguised as CSS content to blend into normal traffic - The sample uses Linux- and Apache-specific tradecraft, including function hooks and RC4 obfuscation, to evade detection
Root Cause: CVE-2025-53521
Evidence points to PoisonedRefresh as a second-stage payload deployed after initial exploitation of CVE-2025-53521 — a critical remote code execution flaw in BIG-IP APM that F5 reclassified from a denial-of-service issue back in March. The vulnerability affects BIG-IP 17.x, 16.x, and 15.x when an APM access policy is configured on a virtual server; specially crafted unauthenticated traffic can crash and restart the TMM process, creating a path to root-level RCE. CISA has added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog.
F5 released fixes in February 2025 — patched versions include 17.1.0.4, 16.1.4.3, and 15.1.10.2 or later. Systems that have reached end of technical support should be treated as unprotected.
A Broader, Staged Operation
Researchers believe PoisonedRefresh is only one piece of a larger attack chain. A related installer component:
- Infects the HTTP server binary
- Preserves access through BIG-IP upgrade images so persistence can survive updates
- Modifies SELinux settings
- Deploys the runtime payload
Because of this, simply restarting the affected service is not a reliable recovery step — it may leave the underlying persistence mechanism intact. Attribution remains unconfirmed; Sophos says the implant's design points to a targeted second-stage operation rather than a mass-market attack against generic Apache or CMS installs.
Detection Guidance
Organizations that suspect compromise should preserve volatile evidence before touching the host — process memory and running-process details matter here since the payload lives in memory. Specifically look for:
- Apache worker processes reading unusual process memory maps
- Temporary write-and-execute permission changes around
libphp - Unexpected local sockets
- Child processes spawning
bashfrom Apache workers
Follow F5's remediation and compromise-assessment guidance for affected APM versions before making generic Apache or PHP configuration changes, since those alone won't remove the rootkit.
Recommendations
- Confirm all BIG-IP APM instances are patched to 17.1.0.4, 16.1.4.3, 15.1.10.2, or later
- Retire or isolate any BIG-IP systems past end of technical support
- Hunt for the memory-resident indicators above rather than relying solely on disk-based file integrity monitoring
- Treat a suspected compromise as requiring a full rebuild from a known-good image, not just a service restart