Full Report
A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk. [...]
Analysis Summary
# Incident Report: Deployment of "PoisonedRefresh" Linux Rootkit on F5 BIG-IP
## Executive Summary
Threat actors are deploying a sophisticated Linux rootkit, dubbed "PoisonedRefresh," targeting F5 BIG-IP APM devices by exploiting a critical RCE vulnerability (CVE-2025-53521). The malware achieves extreme stealth by injecting a fileless PHP web shell directly into memory and intercepting Apache processes, allowing for persistent, diskless command execution. The primary impact is full system compromise and the ability to intercept legitimate web traffic without altering files on disk.
## Incident Details
- **Discovery Date:** September 8, 2026 (Public reporting by Sophos/ESET)
- **Incident Date:** Ongoing; exploitation followed vulnerability reclassification in March 2026
- **Affected Organization:** Multiple; ~795 vulnerable endpoints exposed globally
- **Sector:** Cross-sector (Users of F5 BIG-IP APM)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** March 2026 – September 2026
- **Vector:** Exploitation of CVE-2025-53521
- **Details:** Attackers exploited a critical Remote Code Execution (RCE) flaw in F5 BIG-IP APM that was originally misclassified as a Denial of Service (DoS) issue.
### Lateral Movement
- **Details:** The rootkit establishes a local UNIX socket backdoor to launch interactive Bash shells. While this requires a foothold, it facilitates movement within the device environment without opening traditional network ports.
### Data Exfiltration/Impact
- **Details:** The primary impact is the establishment of a persistent, fileless "on-demand" execution environment. Attackers can intercept PHP file loading to execute arbitrary code and potentially harvest credentials or data passing through the APM.
### Detection & Response
- **Discovery:** Identified by Sophos and ESET through technical analysis of second-stage payloads.
- **Response Actions:** F5 reclassified the vulnerability; researchers released behavioral indicators (IOCs) to help organizations identify memory-resident threats.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2025-53521 (RCE).
- **Persistence:** Modified BIG-IP upgrade images and SELinux configurations to survive system updates.
- **Privilege Escalation:** Not explicitly detailed, but involves infecting the root-level `httpd` executable.
- **Defense Evasion:** Use of RC4 encryption for strings; fileless execution (memory-only PHP injection); hooking `__libc_start_main` to execute before the host application.
- **Credential Access:** Potential for intercepting authentication traffic via PHP hooks.
- **Discovery:** Scans for specific Apache modules (`apr_dso_load`) and legitimate PHP scripts (`apm_css.php3`).
- **Lateral Movement:** Local UNIX socket (`/run/bigtlog.pipe`) for Bash access.
- **Collection:** Interception of memory-resident PHP buffers.
- **Impact:** Full administrative control and stealthy server-side code execution.
## Impact Assessment
- **Financial:** High (Potential for large-scale credential theft and incident response costs).
- **Data Breach:** Risk of intercepted session data and credentials via the APM.
- **Operational:** High; compromise of critical edge networking infrastructure.
- **Reputational:** Significant for F5 due to the vulnerability reclassification.
## Indicators of Compromise
- **Network indicators:**
- POST requests to `.php3` endpoints (e.g., `apm_css.php3`) resulting in an `HTTP 201` response.
- Responses with `Content-Type: text/css` that contain encrypted or PHP-eval payloads.
- **File indicators:**
- Modified `/usr/sbin/httpd` binary.
- Presence of `/run/bigtlog.pipe` (UNIX socket).
- **Behavioral indicators:**
- Apache worker processes reading `/proc/self/maps`.
- Modifications to `libphp` memory protections.
- Unexpected spawning of `/bin/bash` from Apache processes.
## Response Actions
- **Containment:** Isolate affected BIG-IP devices from the network.
- **Eradication:** Reinstall F5 BIG-IP from a known-clean image, as the rootkit persists across standard upgrades.
- **Recovery:** Patch CVE-2025-53521 and rotate all credentials managed by or passing through the APM.
## Lessons Learned
- **Vulnerability Triage:** The initial misclassification of an RCE as a DoS provided attackers a window of opportunity.
- **Memory Forensics:** Traditional disk-based antivirus is ineffective against fileless rootkits that hook into memory-resident loaders.
## Recommendations
- **Immediate Patching:** Apply F5 security updates addressing CVE-2025-53521.
- **Monitor Runtime:** Implement integrity monitoring for core system binaries like `httpd`.
- **Enhanced Logging:** Configure WAFs or logging agents to flag `HTTP 201` status codes originating from PHP scripts that typically return `200 OK`.