Sophos and ESET Detail Fileless Rootkit Exploiting F5 BIG-IP Flaw
A sophisticated Linux rootkit is actively compromising F5 BIG-IP Access Policy Management (APM) devices by injecting fileless web shells into memory. The malware, identified as 'PoisonedRefresh' by ESET and analyzed by Sophos, leverages CVE-2025-53521 to bypass traditional disk-based detection. It modifies Apache and PHP runtime behavior to maintain persistent access without writing malicious files to the hard drive, posing a significant threat to unpatched enterprise gateways.
