Posted on

F5 BIG-IP APM PoisonedRefresh – In-Memory PHP Web Shell and Persistent Appliance Rootkit

Threat Overview

Sophos published new technical analysis in September 2026 of a Linux implant associated with compromised F5 BIG-IP Access Policy Manager environments. The malware is linked to the c05d5254 / PoisonedRefresh activity associated by F5 with exploitation of CVE-2025-53521, an unauthenticated remote-code-execution vulnerability affecting BIG-IP APM when an access policy is configured on a virtual server. The implant modifies the BIG-IP Apache httpd binary and injects a PHP web shell into memory when Apache loads specific APM webtop scripts. Because the final web shell does not need to exist on disk, normal file-integrity checks of the PHP scripts can appear clean while the running process serves attacker-controlled content. Sophos also identified a local UNIX socket at /run/bigtlog.pipe that can be redirected into /bin/bash, creating a second access path without opening a listening TCP port.

References

Impacted Systems

Vendor/product: F5 BIG-IP Access Policy Manager. Relevant configuration: an APM access policy assigned to a virtual server. CVE-2025-53521 affected BIG-IP APM 17.5.0-17.5.1, 17.1.0-17.1.2, 16.1.0-16.1.6, and 15.1.0-15.1.10. Fixed releases reported by F5 and cited in current reporting are 17.5.1.3, 17.1.3, 16.1.6.1, and 15.1.10.8. Platform: BIG-IP Linux appliance. Observed artifacts include /run/bigtlog.pipe, /run/bigstart.ltm, modified /usr/bin/umount and /usr/sbin/httpd, and SHA-256 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9. Targeted APM scripts are apm_css.php3, full_wt.php3, and webtop_popup_css.php3.

Why this matters

BIG-IP APM is commonly Internet-facing and sits directly in remote-access and authentication paths. This malware persists inside appliance binaries and manipulates PHP content only at runtime, defeating file-only web-shell detection and creating a high-impact blind spot on a security appliance.

Exploitation Status

CVE-2025-53521 is confirmed exploited and is listed in CISA’s Known Exploited Vulnerabilities catalog. Sophos analyzed a malware sample associated with compromised BIG-IP APM environments and F5’s c05d5254 activity. Sophos did not attribute the malware to a specific threat actor and did not identify a victim in its sample analysis. The current research expands technical understanding of post-compromise persistence rather than establishing a new exploitation start date.

What this hunt looks for

Published filesystem and pipe indicators, localhost iControl REST activity, SELinux disablement, references to modified BIG-IP binaries, access to targeted APM PHP scripts, unusual HTTP 201/CSS response behavior, Apache process-introspection markers, and base64 or shell execution through BIG-IP management paths.

Required logs

BIG-IP Syslog and audit logs are the highest-value sources. Reverse-proxy, WAF, or other normalized network-security telemetry in CommonSecurityLog can provide HTTP and connection pivots. Visibility is limited if appliance system/audit logging and upstream HTTP telemetry are not ingested into Microsoft Sentinel.

First Pass – Published F5 Malware File and Pipe Indicators

Syslog
| where TimeGenerated >= ago(90d)
| where SyslogMessage has_any ("/run/bigtlog.pipe","/run/bigstart.ltm","26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

iControl REST Activity From Localhost

Syslog
| where TimeGenerated >= ago(90d)
| where SyslogMessage has_any ("restjavad","iControl REST","127.0.0.1","localhost")
| where SyslogMessage has_any ("POST","bash","util","command")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

SELinux Disablement on BIG-IP Appliances

Syslog
| where TimeGenerated >= ago(90d)
| where SyslogMessage has_any ("SELinux","setenforce")
| where SyslogMessage has_any ("disabled","permissive","setenforce 0")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Commands Referencing Published BIG-IP Persistence Artifacts

Syslog
| where TimeGenerated >= ago(90d)
| where SyslogMessage has_any ("/usr/bin/umount","/usr/sbin/httpd","/run/bigstart.ltm","/run/bigtlog.pipe")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Requests to Targeted BIG-IP APM PHP Scripts

CommonSecurityLog
| where TimeGenerated >= ago(90d)
| where RequestURL has_any ("apm_css.php3","full_wt.php3","webtop_popup_css.php3")
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

HTTP 201 CSS Responses Associated With APM Webtop Traffic

CommonSecurityLog
| where TimeGenerated >= ago(90d)
| where RequestURL has_any ("apm_css.php3","full_wt.php3","webtop_popup_css.php3") or Message has_any ("apm_css.php3","full_wt.php3","webtop_popup_css.php3")
| where Message has "201" and Message has "css"
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

Apache Process Introspection and Memory-Permission Indicators

Syslog
| where TimeGenerated >= ago(90d)
| where SyslogMessage has_any ("/proc/self/maps","/proc/self/exe","apr_dso_load","libphp","mprotect","mmap")
| where SyslogMessage has_any ("httpd","apache")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Base64 and Shell Execution Through BIG-IP Management Paths

Syslog
| where TimeGenerated >= ago(90d)
| where SyslogMessage has_any ("restjavad","iControl","/mgmt/")
| where SyslogMessage has_any ("base64","/bin/bash","bash -c","bigstart.ltm")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

Detection Notes

The highest-signal indicators are /run/bigtlog.pipe, /run/bigstart.ltm, integrity changes to /usr/bin/umount or /usr/sbin/httpd, suspicious localhost iControl REST activity, and shell execution recorded in BIG-IP audit logs. The three PHP script names are not malicious by themselves and F5 explicitly cautions that their presence or normal access does not establish compromise. HTTP 201 responses with a CSS content type are behavioral pivots, not proof of the web shell. Because the final PHP web shell is injected only into memory, absence of an altered .php3 file on disk is weak evidence.

Leave a comment