SOPHOSLABS published a technical analysis on 8 September 2026 describing PoisonedRefresh, a fileless Linux rootkit used against F5 BIG-IP APM environments. The rootkit operates in memory to inject a PHP web shell into the BIG-IP APM Apache process, leaving few persistent, on-disk artefacts. The initial access vector is CVE-2025-53521, an unauthenticated remote code-execution flaw in BIG-IP APM when an access policy is configured on a virtual server; Shadowserver noted hundreds of exposed endpoints at disclosure.
The first-stage component—hidden inside a modified Linux unmount binary—infects /usr/sbin/httpd, alters SELinux settings, and can be embedded in BIG-IP upgrade images to survive updates. The second stage is a standalone Linux ELF that uses its own loader and intercepts libc_start_main to execute before Apache fully starts, enabling memory-only payloads and delaying detection.
The second stage hooks the APR module loader (apr_dso_load) and, once PHP’s libphp is loaded, manipulates memory protections to inject a PHP web shell into the running process. The web shell targets three BIG-IP APM webtop script files (apm_css.php3, full_wt.php3, webtop_popup_css.php3) and, when mapped into memory, returns the original content plus an embedded shell without touching the disk.
It communicates via a local UNIX socket at /run/bigtlog[.]pipe, authenticates with the token Kzwd6jM5, and spawns /bin/bash for interactive access, avoiding open TCP ports. Operational strings are RC4-encrypted with the key TrswBWIl90Z5e38n, decrypted only when needed. F5 provides remediation guidance for CVE-2025-53521 and recommends compromise assessment before any generic hardening. The analysed sample’s SHA-256 is 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9.