SECURITY researchers have linked a stealth Linux implant, described as a PHP web server rootkit, to targeting F5 BIG-IP Access Policy Management (APM) environments. The campaign is associated with the Poisoned Refresh family and appears to operate entirely in memory, injecting a PHP web shell into runtime structures without altering on-disk files. The activity is being tracked by F5 under the cluster name c05d5254, with SophosLabs and ESET providing technical breakdowns and corroboration.
Attackers gain initial access by exploiting an unauthenticated remote code execution flaw in BIG-IP APM, tracked as CVE-2025-53521. After breach, a first-stage loader — embedded in a modified Linux umount utility — establishes persistence and modifies SELinux policies, followed by infection of the Apache web server binary on disk. When the Apache daemon starts and the PHP interpreter module is loaded, a custom ELF loader maps code into memory and intercepts the startup sequence.
The rootkit then hooks the Apache Portable Runtime library to locate PHP in memory and injects a fileless web shell ahead of legitimate scripts, leaving the actual disk files seemingly clean.
The backdoor offers two command channels: an in-memory HTTP-based shell that authenticates via a prefix and decrypts commands with a stream cipher, and a local UNIX-domain socket backdoor activated by a hardcoded token. Defence guidance calls for patching vulnerable BIG-IP appliances, verifying firmware integrity, and auditing running processes, memory mappings, and unusual UNIX socket listeners, since detection can be missed by standard file integrity checks.