Sophos and ESET Detail Fileless Rootkit Exploiting F5 BIG-IP Flaw

Key points

• The malware targets F5 BIG-IP APM environments, exploiting CVE-2025-53521, a critical remote code execution flaw previously misclassified as a denial-of-service issue by F5.
• Sophos and ESET identified the payload as a second-stage implant that hooks into Apache’s APR module loader and intercepts PHP file loading via memory mapping (mmap) to inject web shells into legitimate scripts like apm_css.php3.
• The rootkit uses RC4 encryption to hide operational strings and executes before the host application’s main() function by intercepting __libc_start_main, ensuring early and stable access.
• It creates a local UNIX socket backdoor for interactive Bash access without opening a TCP port, requiring a separate foothold for external attackers to utilize this channel.
• The ShadowServer Foundation reports that 795 vulnerable endpoints were exposed online as of the latest tracking data, highlighting the ongoing risk to unpatched systems.

Background

This incident follows a trend of advanced Linux rootkits targeting web servers, such as the SPECTRE rootkit observed in August 2026, which used AI-assisted tooling for EDR evasion. While previous threats often relied on disk-based implants, this new malware represents a shift toward in-memory execution to evade file integrity monitoring. The vulnerability exploited, CVE-2025-53521, was reclassified by F5 Networks in March 2026 from a DoS issue to a critical RCE flaw, indicating a delayed recognition of its severity.

How outlets are covering it

Sophos provided the most granular technical analysis, detailing how the malware hooks apr_dso_load and manipulates libphp memory protections to achieve fileless execution. ESET independently identified the same malware family, naming it 'PoisonedRefresh,' and confirmed overlapping behaviors. BleepingComputer synthesized these findings to highlight the operational impact, noting that the malware persists across BIG-IP upgrade images and modifies SELinux configurations. CyberSecurityNews and gbhackers.com reported the story with less technical depth, focusing primarily on the fileless nature of the web shell and the vulnerability’s exploitation status. All sources agree on the criticality of the flaw and the sophistication of the in-memory injection techniques, but Sophos offers the most comprehensive view of the malware’s internal mechanics and detection signals.

Why it matters

This rootkit undermines traditional security assumptions that rely on file-based detection. By injecting code into memory and leaving disk files unchanged, it evades standard file integrity monitoring and antivirus scans. The persistence across upgrade images means that simply patching the system may not remove the threat if the underlying installer remains. Organizations using F5 BIG-IP APM must immediately apply patches for CVE-2025-53521 and monitor for anomalous memory access patterns in Apache processes to mitigate this advanced threat.

What to watch

Defenders should implement the detection signals provided by Sophos, such as monitoring for Apache workers reading /proc/self/maps or unusual POST requests to .php3 endpoints. F5 Networks is expected to continue urging customers to follow their remediation and compromise-assessment guidance. Security researchers will likely continue to analyze the installer component to understand the full scope of the infection chain and identify any additional backdoors.