GoKawiilSophos finds fileless Linux rootkit hitting F5 BIG-IP APM devices
Sophos researchers detailed a second-stage Linux rootkit infecting F5 BIG-IP APM systems, likely delivered after attackers exploited the critical CVE-2025-53521 remote code execution flaw. The malware infects Apache's httpd process, hooks internal functions to intercept PHP file loading, and injects a web shell into memory rather than writing files to disk, while also altering SELinux settings and persisting through firmware upgrades. ESET separately analyzed the same threat under the name PoisonedRefresh.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the implant never touches disk-based PHP files and hides deep inside Apache's runtime, it evades typical file-integrity and antivirus checks, making detection and remediation far harder for enterprises running BIG-IP APM. Its persistence across system upgrades also means simply patching or updating firmware may not remove the infection, raising the stakes for organizations relying on F5 devices for secure remote access.
- A stealthy Linux rootkit hijacks Apache's PHP loading process to hide a memory-resident web shell.
- The malware likely follows exploitation of F5's critical CVE-2025-53521 RCE vulnerability, first misclassified as a DoS bug.
- It survives BIG-IP firmware upgrades and alters SELinux settings, complicating detection and cleanup efforts.
Practical Malware Analysis (No Starch Press) — If reading about fileless webshells and RC4-obfuscated Linux rootkits makes you want to dig into the binaries yourself, this No Starch Press classic is the standard hands-on guide to reverse engineering malicious code. It walks through disassembly, debugging, and unpacking techniques — exactly the tradecraft Sophos and ESET researchers used to pick apart PoisonedRefresh.
See Practical Malware Analysis (No Starch Press) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-08
Published there as: “Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.