SophosLabs acquired a Linux implant linked to compromised BIG-IP APM systems running Apache and PHP components. The malware delivers on-demand server-side code execution, a familiar web shell outcome, but its implementation draws on deep Linux and Apache tradecraft rarely seen outside nation-state tooling.
F5 associates this activity, identified by the c05d5254 hash, with BIG-IP APM systems vulnerable to CVE-2025-53521, an exploited unauthenticated Remote Code Execution flaw. The malware specifically targets Apache, libphp, APR module loading, and BIG-IP APM webtop components.
How the Implant Hides Itself
The implant uses custom ELF loading, function hooking, and runtime code patching to evade detection, maintaining persistent access through hidden web shells. Sophos identifies this sample as a second-stage payload.
A separate installer component handles infecting /usr/sbin/httpd and persists across BIG-IP upgrade images. This first-stage loader watches for BIG-IP upgrade workflows and modifies SELinux configurations as part of establishing its foothold.
The second-stage sample hides its operational strings using RC4 encryption and gains execution early by intercepting __libc_start_main.
_start -> __libc_start_main(main, ...) -> main()
Normal execution flow looks like the above. The implant’s version looks like this instead:
_start -> custom loader -> real __libc_start_main(wrapper, ...) -> wrapper() -> real main() wrapper() runs implant initialization wrapper() then calls the real main
From there, the malware targets Apache’s PHP module by hooking apr_dso_load, then injects a PHP web shell directly into memory. This manipulation of mmap behavior inside libphp means the malicious content is visible only to the infected process and never touches disk. The implant also creates a local UNIX domain socket for interactive /bin/bash access, all without opening a TCP port.
Why File Scanners Miss It
This rootkit breaks the assumptions most web shell detection tools rely on. Traditional web shells sit as small scripts on disk, the kind file integrity monitoring is built to catch. This implant sidesteps that model in three distinct ways:
- No static file to find. The web shell capability exists, but it isn’t anchored to a script on disk. Instead, it intercepts PHP file loading and prepends the web shell to in-memory representations at
mmap()time. - Compromise runs at the process level. The malware redirects libc and libphp function calls within Apache worker processes, so every PHP-based component executes inside a manipulated runtime. Older web shells like China Chopper relied on much simpler file-based access.
- Two ways in, not one. Attackers can use the HTTP-driven PHP payload or fall back on the local UNIX socket backdoor, giving them an interactive shell without ever needing a listening TCP port.
The result functions like a web shell from an attacker’s perspective, but is significantly harder to catch with file-centric or PHP-only detection methods. A tool inspecting PHP files on a compromised host may simply see a different reality than what’s actually running in memory.
Sophos researchers note that ESET independently analyzed the same malware, dubbing it PoisonedRefresh.
The targeting and implementation point to a high level of operational sophistication behind the campaign.
Organizations running affected BIG-IP APM versions should follow F5’s remediation and compromise assessment guidance before applying generic hardening steps.
Hashlytics Take
The part worth internalizing here isn’t the specific CVE, it’s the detection model this malware breaks. File integrity monitoring and PHP file scanning have been baseline advice for years, and this implant is purpose-built to sail past both. If your incident response playbook still treats “check the filesystem for suspicious PHP” as sufficient, this is the reminder that memory and process visibility now belong in that same first pass, not as a follow-up step once something already feels wrong.
Two mitigation steps worth applying regardless of your BIG-IP exposure. Restricting ptrace scope limits the kind of process injection this implant relies on:
echo 1 > /proc/sys/kernel/yama/ptrace_scope
Blocking legacy PHP3 file execution closes off an older attack path some web shells still target:
<FilesMatch ".php3$"> Require all denied </FilesMatch>
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
