Ethical Hacking News
PoisonedRefresh, a sophisticated Linux rootkit, has been discovered to be infecting F5 BIG-IP APM systems, injecting PHP web shells into Apache memory, and leaving no disk artifacts behind. This malware has been found to target deployments featuring Apache, libphp, APR module loading, BIG-IP APM webtop components, and BIG-IP upgrade workflows, suggesting that it was developed specifically for these environments. The initial access vector for PoisonedRefresh is CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM when an access policy is configured on a virtual server. The malware is highly advanced, using custom ELF loading, early startup interception, APR-aware module monitoring, relocation patching, and memory-only payload delivery to deliver its payload.
This article provides an in-depth analysis of PoisonedRefresh, including its technical details and the indicators that could point to its presence. It also provides guidance on how to remediate and assess the impact of this malware on F5 BIG-IP APM systems. Understanding this malware is crucial for organizations that use F5 BIG-IP APM systems and for security professionals who need to stay up to date with the latest threats and vulnerabilities.
PoisonedRefresh is a sophisticated Linux rootkit that infects F5 BIG-IP APM server memory, injecting PHP web shells into Apache memory.The rootkit leaves no disk artifacts behind and was developed specifically for Apache, libphp, and BIG-IP APM environments.The initial access vector is CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM.The rootkit has two stages: the first stage infects the system and the second stage is a standalone ELF binary with its own loader.The malware intercepts libc_start_main, runs its own setup, and injects a PHP web shell into memory by manipulating mmap behavior.The web shell delivery is distinctive, watching for specific BIG-IP APM webtop script files and injecting a modified view.The implant creates a local UNIX socket, connects to it, and starts a shell, making it harder for network monitoring tools to detect.Sophos recommends checking for unusual mmap() or mprotect() calls, access to /proc/self/maps, and the presence of the local socket.
PoisonedRefresh, a sophisticated Linux rootkit, has been discovered by SophosLabs to be infecting F5 BIG-IP APM server memory, injecting PHP web shells into the Apache memory, and leaving no disk artifacts behind. This highly advanced malware has been found to target deployments featuring Apache, libphp, APR module loading, BIG-IP APM webtop components, and BIG-IP upgrade workflows, suggesting that it was developed specifically for these environments.
The initial access vector for PoisonedRefresh is CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM when an access policy is configured on a virtual server. This vulnerability was previously classified as a denial-of-service issue but was later confirmed by F5 as an RCE by the company itself. The Shadowserver Foundation observed 795 internet-exposed endpoints vulnerable to this CVE at the time of disclosure.
The PoisonedRefresh rootkit consists of two stages: the first stage, which is hidden inside a modified Linux umount binary, infects /usr/sbin/httpd, modifies SELinux configuration, and embeds itself in BIG-IP upgrade images to survive device updates. The second stage is a standalone Linux ELF binary that includes its own loader and is designed to give the attacker operational capability.
The second-stage malware is a highly advanced piece of code that intercepts libc_start_main, the function that normally starts Apache, and runs its own setup before Apache begins normal work, before logging systems fully start, and before some security tools can monitor the process. It targets Apache's PHP module by hooking the Apache Portable Runtime (APR) module loader and injects a PHP web shell into memory by manipulating mmap behavior inside libphp at runtime.
The web shell delivery is where the analysis is most distinctive. The implant watches for PHP opening any of three specific BIG-IP APM webtop script files: apm_css.php3, full_wt.php3, and webtop_popup_css.php3. These are legitimate files that exist on the device. When PHP opens one and then maps it into memory, the implant intercepts the mmap() call and returns a modified view: the original script content preceded by the embedded PHP web shell. The on-disk file is never changed. The injected web shell reads raw data from php://input and looks for a special prefix, BSOHAzPB, and then decrypts the rest with a stream cipher using the key wSLjN1beuR and executes the result.
The implant also creates a local UNIX socket at /run/bigtlog.pipe. After a short authentication step using the token Kzwd6jM5, it connects the shell's input, output, and error streams to the socket and starts /bin/bash. This gives the attacker an interactive shell without opening a TCP port, making the activity harder for network monitoring tools to detect.
The malware uses Apache's apr_time_now function as a delayed trigger. It waits until the server has fully started before launching the socket worker, reducing the risk of disrupting Apache during startup. The binary also encrypts its operational strings with RC4 using the hardcoded key TrswBWIl90Z5e38n, which it decrypts only when needed.
Sophos recommends checking several indicators that could point to this malware, including unusual mmap() or mprotect() calls shortly after libphp loads inside Apache worker processes, access to /proc/self/maps followed by changes to memory permissions, and the presence of the local socket /run/bigtlog.pipe. Teams should also look for HTTP 201 responses with Content-Type: text/css when they do not match legitimate CSS or other asset requests.
The SHA-256 hash of the analyzed sample is 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9. F5 has published remediation and compromise-assessment guidance for CVE-2025-53521 and should be the first stop for affected BIG-IP APM operators, before applying any generic Apache or PHP hardening recommendations.
In conclusion, PoisonedRefresh is a highly sophisticated Linux rootkit that has been discovered to be infecting F5 BIG-IP APM systems, injecting PHP web shells into Apache memory, and leaving no disk artifacts behind. Its advanced delivery mechanisms and lack of disk artifacts make it a challenging piece of malware to detect and remove. The fact that it was developed specifically for BIG-IP APM systems suggests that it was designed to take advantage of a vulnerability in these systems.
This incident highlights the importance of keeping F5 BIG-IP APM systems up to date with the latest security patches and following best practices for hardening these systems against attacks. It also emphasizes the need for continuous monitoring and testing of these systems to detect and remove advanced malware like PoisonedRefresh.
Related Information:
https://www.ethicalhackingnews.com/articles/PoisonedRefresh-A-Sophisticated-Linux-Rootkit-with-Far-Reaching-Implications-for-F5-BIG-IP-APM-Systems-ehn.shtml
https://securityaffairs.com/198746/malware/poisonedrefresh-a-fileless-linux-rootkit-that-injects-php-web-shells-into-f5-big-ip-apm-server-memory.html
https://nvd.nist.gov/vuln/detail/CVE-2025-53521
https://www.cvedetails.com/cve/CVE-2025-53521/
Published: Wed Sep 9 05:29:16 2026 by llama3.2 3B Q4_K_M
