Linux rootkit on F5 BIG-IP APM hides its web shell in memory

Sophos X-Ops has published an analysis of a Linux implant recovered from compromised F5 BIG-IP APM environments. The malware injects a PHP web shell into memory instead of dropping a file, so the scripts on disk stay byte-for-byte clean while Apache executes attacker code. The research went out on 7 September 2026.

ESET analysed the same malware in parallel and named it PoisonedRefresh. Sophos detects the payload as Linux/Agnt-IC.

Sophos assesses this sample as a second stage. During analysis of a related umount sample it found a separate installer component that infects /usr/sbin/httpd, modifies SELinux configuration and persists across BIG-IP upgrade images. The malicious prefix size in the infected httpd matches the payload embedded in the umount sample, which is what ties the two together.

The implant runs before the host program does. It hooks __libc_start_main so its own initialisation happens ahead of main(), and it carries its own ELF loader rather than going through the dynamic linker, which removes the startup path many monitoring tools watch.

Then it waits. By hooking the Apache Portable Runtime function apr_dso_load, it stays inert until Apache loads libphp. Only then does it read /proc/self/maps to locate that module, flip its memory protections to RWX, patch selected call targets and set them back to RX.

read /proc/self/maps -> find libphp -> mprotect RWX -> patch relocations -> mprotect RX

Those patches redirect PHP's file and memory calls, including open, close, mmap and __fxstat. When PHP opens apm_css.php3, full_wt.php3 or webtop_popup_css.php3, the implant tracks the descriptor and prepends a web shell to the mapped content at mmap time. Sophos notes these scripts exist in BIG-IP APM webtop environments and are unlikely to draw attention.

Operational strings sit encrypted in .rodata behind a hardcoded RC4 key, so a static string dump gives an analyst almost nothing.

The injected web shell reads raw bytes from php://input, checks for a short magic prefix, decrypts the remainder with a small stream cipher and runs it through eval(). It answers with HTTP status 201 and a Content-Type of text/css, so on a traffic graph it looks like a stylesheet fetch.

The second channel is local. The implant creates a UNIX domain socket at /run/bigtlog.pipe and, after a token check, redirects standard input, output and error into /bin/bash. No TCP listener opens, so port-based monitoring and external scans see nothing.

Sophos found no client code for that socket and no other reference to its token, and says it cannot confirm whether operators reach it through the web shell. The socket worker only spawns once Apache starts making routine time calls, a delay that keeps the implant from destabilising the service at startup.

F5 links the related activity, which it tracks as c05d5254, to BIG-IP APM systems affected by CVE-2025-53521. That flaw has a history worth remembering.

F5 disclosed and patched it on 15 October 2025 as a denial of service issue in the apmd process, scored 7.5 under CVSS v3.1 and 8.7 under v4.0. In March 2026, citing new information, F5 re-categorised it as unauthenticated remote code execution and raised the scores to 9.8 and 9.3. The advisory now states the flaw has been exploited in vulnerable versions.

CISA added it to the KEV catalog on 27 March 2026 and gave federal agencies until 30 March. F5 classifies the bug as CWE-121, a stack-based buffer overflow, affecting BIG-IP APM 15.1.0 to 15.1.10, 16.1.0 to 16.1.6, 17.1.0 to 17.1.2 and 17.5.0 to 17.5.1 when an access policy is configured on a virtual server. It is a data plane issue, and appliance mode is not a shelter.

Anyone who triaged a 7.5 denial of service in October 2025 and scheduled it accordingly had five months of exposure to something rather different.

The Shadowserver Foundation runs a tracker for BIG-IP APM systems vulnerable to CVE-2025-53521. BleepingComputer, reading that dashboard on 8 September 2026, reported 795 exposed endpoints the previous day.

For scale, Shadowserver fingerprinted around 17,000 BIG-IP APM instances globally in early April 2026, though that was a population count rather than a vulnerable one. Six months after the reclassification, several hundred systems still answer as vulnerable.

That matters more than the raw number suggests. BIG-IP APM enforces authentication and authorisation for VPN and application access, so each exposed appliance is a pre-auth foothold standing in front of everything it protects. F5's own guidance tells anyone running a vulnerable version, or upgraded from one, to review its compromise indicators rather than assume a patch settled the matter.

Start with F5's guidance rather than generic Apache or PHP hardening. F5 publishes indicators of compromise for c05d5254 in article K000160486 and separate guidance for suspected BIG-IP compromise. Sophos makes the same point: on these appliances, follow F5's remediation path first.

On the web layer, look for requests to the three .php3 endpoints where they are rare in your environment, and for PHP responses pairing HTTP 201 with a text/css content type. Repeated POSTs of consistent shape or unusual body size to CSS-like PHP paths are the same signal from another angle.

On the host, the tell is behavioural. Apache workers reading /proc/self/maps, memory protections on libphp flipping to RWX and back, a UNIX socket appearing at /run/bigtlog.pipe, or Apache lineage processes redirecting stdio and executing /bin/bash.

Sophos recommends collecting process memory and comparing on-disk against in-memory module contents for critical web servers. That comparison is the one check this implant cannot pass.

Attribution is open. Sophos says it lacks sufficient evidence to tie the implant to a named actor, while noting that the targeting and implementation suggest operational maturity.

Two threads are worth following. Whether the missing client component for the UNIX socket surfaces, which would say something about how the operators work, and whether the installer stage gets a public write-up, since that is the piece handling persistence across upgrade images.

The wider lesson is about method rather than this particular malware. In-memory web shell delivery breaks the assumption that a compromised web server leaves something suspicious on disk, and BIG-IP APM will not be the last appliance where that assumption gets tested.