Poisoned Refresh Rootkit Backdoors F5 BIG-IP APM viaCVE-2025-53521

Sophos X-Ops has published a deep analysis of a stealthy Linux rootkit found on compromised F5
BIG-IP Access Policy Manager (APM) appliances, tracked by F5 as c05d5254 and named
PoisonedRefresh by ESET. The malware is deployed to BIG-IP APM systems exploited through CVE
2025-53521, an unauthenticated remote code execution flaw, and gives attackers on-demand server
side code execution through a web shell that runs entirely in memory, leaving nothing on disk for
traditional file-based detection to find. A first-stage installer infects the Apache web server binary,
disables SELinux, and embeds itself in BIG-IP upgrade images so it survives updates and can spread
to other appliances, while the second stage hooks core Linux and Apache functions to inject the hidden
PHP web shell and opens a covert local shell channel with no network listener. Because this targets a
security appliance at the network edge, persists across upgrades and evades disk-based checks, any
organisation that ran a vulnerable BIG-IP APM version should treat affected devices as potentially
compromised and follow F5’s compromise-assessment guidance.

1. Campaign Overview

Sophos X-Ops (7 September 2026) analysed a Linux implant recovered from compromised F5 BIG-IP APM environments
that use Apache and PHP components. F5 associates the related c05d5254 activity with BIG-IP APM systems affected
by CVE-2025-53521, an exploited unauthenticated remote code execution flaw that occurs when an access policy is
configured on a virtual server, and has published indicators of compromise (K000160486) and the F5 System Scanner.
ESET independently analysed the same malware and named it PoisonedRefresh. The implant delivers the familiar
outcome of a web shell, but implements it with deep Linux and Apache tradecraft, and F5, ESET and Sophos are
describing one and the same threat.

2. Targeting

The malware is purpose-built for BIG-IP APM webtop environments, keying on Apache, libphp, APR module
loading, BIG-IP APM webtop components and BIG-IP upgrade workflows, rather than generic Apache/PHP or
common CMS deployments. The first-stage loader looks for BIG-IP upgrade or install-image workflows under
paths such as /mnt/tm_install. The initial access vector and deployment tradecraft point to a sophisticated threat
actor, though attribution remains undecided. Any organisation that ran a vulnerable BIG-IP APM version at any
point should consider its appliances in scope and prioritise compromise assessment.

3. Attack Details

The chain moves from an unauthenticated RCE on the appliance to a persistent, in-memory web shell and covert shell
access.

• Initial Access CVE-2025-53521: Attackers exploit the unauthenticated remote code execution flaw in BIG-IP APM (present when an access policy is configured on a virtual server) to gain code execution on the appliance.
• Installation FIRST-STAGE UMOUNT LOADER: Run as root against /mnt/tm_install/, the umount installer prepends a malicious ELF to /usr/sbin/httpd, disables SELinux, and infects umount, httpd and rc.local within the install image so the malware persists across BIG-IP upgrades and can spread to other appliances.
• Execution PRE-MAIN HOOKING: The second-stage payload hides its strings with RC4 and gains execution before the host application’s main() by hooking __libc_start_main, so it runs inside every affected Apache worker process.
• Web Shell IN-MEMORY PHP INJECTION: It hooks Apache’s APR module loader (apr_dso_load) to target libphp and injects a PHP web shell into memory by manipulating mmap at runtime, so only the infected process sees the malicious content and nothing is written to disk.
• Access DUAL CHANNELS: Beyond the HTTP-driven PHP web shell, the implant opens a local UNIX domain socket that can redirect a connection into /bin/bash, giving interactive shell access without opening any TCP listening port.

4. Malware & Capabilities

PoisonedRefresh is a process-level compromise designed for stealth and durability on the appliance.

• Fileless web shell: The web shell capability is not anchored to a static script on disk; the implant intercepts loading of specific PHP files and prepends the web shell to their in-memory representation at mmap() time, defeating web-root scanning and file-integrity monitoring.
• Process-level runtime manipulation: By redirecting selected libc and libphp function calls inside Apache worker processes, every PHP component running in that process (plugins, scanners, local scripts) executes inside a manipulated runtime environment.
• Persistence and anti-forensics: The first stage infects the Apache binary and BIG-IP upgrade images to survive updates, disables SELinux (setting httpd_t, mount_t and/or apd_t domains to permissive), and disguises activity with HTTP 201/401 responses carrying a CSS content-type.
• Covert local access: A local UNIX domain socket bridges to /bin/bash for interactive access with no TCP listener, alongside operational artifacts such as /run/bigtlog.pipe and /run/bigstart.ltm.

5. Indicators of Compromise (IOCs)

6. Recommendations

• Assess for compromise now: any BIG-IP that ran a vulnerable BIG-IP APM version at any point, regardless of current version, should be reviewed against F5’s indicators (K000160486) and scanned with the F5 System Scanner. If it flags a mismatch, especially on /usr/bin/umount or /usr/sbin/httpd, open an F5 support case with the Scanner results and a QKView, and follow F5 K11438344 for suspected compromise.
• Remediate CVE-2025-53521: apply F5’s fixed BIG-IP APM versions and remediation guidance, and restrict and monitor external access to BIG-IP APM virtual servers that have an access policy configured.
• Hunt host indicators and block the file hashes: check for /run/bigtlog.pipe and /run/bigstart.ltm (including via lsof -n), hash/size/timestamp mismatches on the F5-listed binaries, and block the file hashes in the Indicators of Compromise section at your endpoint controls.
• Verify SELinux state: getenforce should return Enforcing (Permissive or Disabled is an indicator), semanage permissive -l should not list httpd_t, mount_t or apd_t, and auditd should show no unexpected setenforce (enforcing=0) events.
• Review logs and webtop artifacts: restjavad-audit entries showing local f5hubblelcdadmin using the iControl REST bash utility from localhost, audit ‘run util bash’ events echoing Base64 to a file and executing/run/bigstart.ltm, changes to the webtop renderer PHP files, HTTP 201/401 responses with a CSS content type, and /usr mounted read-write. Remember the web shell is usually in memory only, so these files may be unmodified.
• If compromise is confirmed, treat the appliance as fully compromised: because the malware persists across upgrade images and runs in memory, follow F5’s compromised-system guidance, rebuild from known-good media, and rotate all credentials, keys and certificates the device handled.

7. Sources

• https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit
• https://infosec.exchange/@ESETresearch/116460555146536345
• https://my.f5.com/manage/s/article/K000160486

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.