.jpg)
if ( !emtpy($headline_subheadline ) ) : ?>
By compromising BIG-IP APM systems, attackers may gain access to credentials, SSO tokens and trusted pathways into downstream applications.
endif; ?>
A newly analyzed Linux rootkit is believed to have given attackers a way to hide shells inside recently compromised F5 BIG-IP Access Policy Management (APM) environments, without leaving the malicious PHP code on disk.
Sophos said the malware, found in compromised BIG-IP APM environments using Apache and PHP components, uses custom ELF loading, function hooking, and runtime code patching to establish persistent access. The implant, it said in a blog post, appears to be tailored specifically to BIG-IP APM webtop environments, rather than being a generic Apache or PHP attack.
The activity has been linked to the exploitation of CVE-2025-53521, an unauthenticated remote code execution (RCE) vulnerability affecting BIG-IP APM when an access policy is configured on a virtual server.
Sophos said the sample they have now found and analyzed is a second-stage payload, while a previously identified component is responsible for infecting the Apache “httpd” process and deploying this payload.
The web shell is not really a file
Sophos’ analysis focused on how the malware delivers its web shell.
Rather than dropping a suspicious PHP file onto the server, the implant hooks Apache’s PHP-loading process and modifies the way selected PHP files are presented to the running process. Sophos found it specifically targeting three PHP files used by BIG-IP APM’s webtop environment.
These files included “apm_css.php3”, “full_wt.php3”, and “webtop_popup_css.php3.”
When PHP attempts to memory-map one of those files, as part of the routine PHP runtime, the rootkit intercepts the operation and creates a modified in-memory version containing the malicious web shell alongside the legitimate script. The file on disk remains unchanged.
That makes the technique nearly invisible to conventional web-shell detection tools. A scan of the filesystem would show a perfectly legitimate PHP file while the Apache process is executing a modified version in memory.
“The significance here isn’t just that the web shell is stealthier,” said Sean Malone, chief information security officer at BeyondTrust. “It’s that it defeats the assumption most response playbooks rest on: that the file on disk tells you what the server is running.”
The malware serves a poisoned copy of three legitimate BIG-IP APM files only inside the running Apache process, so hashes match, file-integrity monitoring passes, and the box looks clean while it’s owned, Malone explained.
The implant also establishes a second access mechanism through a local UNIX socket, rather than opening a conventional TCP listener. After authentication, the socket can provide an interactive “/bin/bash” session, giving an attacker another way into the system while avoiding some network-based detection.
Sophos said the combination of these techniques creates a web-shell capability that is harder to detect using file-centric or PHP-only monitoring.
Compromise could expose the identity gateway
The implications extend beyond the F5 appliance itself.
“An attacker with access to BIG-IP APM can intercept SSO tokens and credentials, inject policy decisions, monitor user traffic, and move laterally to downstream applications and SaaS tenants that trust the appliance,” said Agnidipta Sarkar, chief evangelist at ColorTokens.
Sarkar noted that BIG-IP APM is commonly deployed by large enterprises, financial institutions, and public-sector organizations to provide remote access and federated SSO to internal applications, APIs, and cloud services. Because the appliances sit at the network perimeter, process credentials and session tokens, and terminate TLS, they represent particularly valuable targets.
For defenders, Sarkar recommended investigating systems that were vulnerable before they were patched, as applying the fix does not rule out an earlier compromise. He also recommends combining F5’s indicators of compromise with memory and behavioral telemetry, since file scans alone may miss the rootkit’s in-memory activity.
.jpeg)
