Press play to start listening
Sophos has published details of a Linux implant found on compromised F5 BIG-IP Access Policy Manager (APM) systems that can hide a PHP web shell inside Apache’s memory. The implant modifies legitimate BIG-IP APM PHP scripts as they are loaded, while leaving the original files unchanged on disk. This allows the web shell to operate without appearing in the files security teams would normally examine for signs of compromise.
This research adds to ESET’s analysis of related samples, which it dubbed PoisonedRefresh. ESET identified an installer component that can modify umount, httpd and rc.local, disable SELinux, and place malicious components inside BIG-IP installation images. Sophos’ sample focuses on the second stage, which provides the web shell and a separate local backdoor.
The BIG-IP APM Flaw Explained
F5 said in its official advisory that the activity is associated with exploitation of an unauthenticated remote code execution (RCE) vulnerability in BIG-IP APM, tracked as CVE-2025-53521. It occurs when an access policy is set on a virtual server.
F5 initially classified the vulnerability as a denial-of-service (DoS) issue but later updated its assessment to remote code execution after further investigation. F5 has also confirmed that the vulnerability has been exploited in attacks.
The affected branches are 15.1.0 through 15.1.10, 16.1.0 through 16.1.6, 17.1.0 through 17.1.2, and 17.5.0 through 17.5.1, with fixes available in versions 15.1.10.8, 16.1.6.1, 17.1.3, and 17.5.1.3. CISA has added it to the Known Exploited Vulnerabilities catalog.
Sophos researchers found a related installer that modifies /usr/sbin/httpd, the Apache server process on BIG-IP before loading the second-stage malware. The malware uses a custom ELF loader to run its code before Apache starts normally and also hooks __libc_start_main, a function involved when Apache starts up.
The implant uses RC4 and a hardcoded key, TrswBWIl90Z5e38, to hide strings used by its code. It also hooks Apache Portable Runtime’s apr_dso_load function and waits for libphp to load before continuing.
Web Shell Runs From Memory
The implant targets three BIG-IP APM webtop scripts: apm_css.php3, full_wt.php3 and webtop_popup_css.php3. When PHP accesses one, the malware intercepts its memory mapping and adds the web shell to the in-memory copy while leaving the original file unchanged.
The PHP payload reads data from php://input, checks for the BSOHAzPB marker, decrypts the request using wSLjN1beu, and executes it through eval(). It returns HTTP 201 with a text/css content type, which can resemble normal web traffic.
A Separate Local Backdoor
Sophos also found a UNIX socket at /run/bigtlog.pipe. After checking the token Kzwd6jM5, the implant redirects standard input, output, and error streams to the socket and launches /bin/bash, providing interactive access without a TCP listener. However, Sophos could not find code that would let an attacker connect directly to the socket or establish whether it is linked to the web shell.
Although F5 listed the three PHP file paths in its compromise-assessment guidance, it warned that their presence alone does not confirm an intrusion because the files are legitimate components of BIG-IP APM. Still, users of the affected BIG-IP APM versions are urged to follow F5’s compromise-assessment and remediation guidance and check affected devices for signs of compromise.
Experts’ Views
Following these findings, several cybersecurity experts shared their views with Hackread.com, highlighting the challenges of detecting the in-memory web shell and the risks of compromising a BIG-IP APM appliance.
Mark Odom, Senior Solutions Engineer at Black Duck, explained why the timing of the injection makes the web shell difficult to detect, stating: “The timing is key: the injection happens after the file is read but before it actually runs, which is when the web shell code is inserted into the in-memory copy. As a result, a file integrity check compares a clean disk copy against a known-good hash and comes back clean, while the web shell stays hidden in memory. This means file integrity checks can’t be trusted as an indicator of compromise here.”
Agnidipta Sarkar, Chief Evangelist at ColorTokens, highlighted the potential impact of a compromised BIG-IP APM appliance, particularly because these systems can handle credentials and session tokens:
“These appliances operate at the network perimeter, process live credentials and session tokens, and terminate TLS, making them critical assets and high-value targets. The attack strategy is highly stealthy. A layered response is essential: establish a patching zone with software controls, apply patches to prevent new breaches, and use F5’s IOCs along with memory and behavioral telemetry for threat hunting, as file scans alone may not detect the compromise.”
