A newly discovered Linux rootkit is exposing a sharp blind spot in server security: it injects web shells into F5 BIG-IP Access Policy Manager (APM) servers running Apache and PHP without ever leaving a PHP file behind on disk. The malicious code operates purely in memory, making it invisible to normal file scans and enabling attackers to maintain persistent, stealthy access. The vulnerability is tied to CVE-2025-53521, an unauthenticated remote code execution weak point in BIG-IP APM already flagged in earlier alerts.
How the Attack Works
Security researchers from Sophos, investigating compromised BIG-IP APM systems, uncovered that the malware deploys at a very early stage—before the usual mainroutine in Apache starts. It loads its own image, preserves the original executable, and hooks into core Linux startup routines. The rootkit then monitors Apache’s module loader and waits for the PHP component (libphp). When certain APM web-top PHP scripts are loaded into memory (three specific ones), the malware builds a modified version that combines the original content with a web shell. The script itself on disk remains intact, so regular file-based inspections won’t detect anything unusual. Attackers can then send specially crafted requests, decrypt them, and execute code on the server behind the scenes.
Additional Stealth & Backdoor Mechanisms
Besides the in-memory web shell, the rootkit also establishes a local Unix socket that gives privileged access to a Bash shell—but only after a secret authentication token. Because no TCP port is used, network scans may miss this entirely. Persistence is bolstered by a component that infects the Apache binary itself, ensures the code remains over BIG-IP upgrade workflows, adjusts SELinux settings, and deploys the in-runtime payload. Simply restarting Apache won’t remove the malware or the earlier installer stage’s modifications.
The behavior of the rootkit is especially sly. Some HTTP responses include a 201 status and masquerade as CSS files—tricks that hide their activity in server logs. The implant also patches specific file and memory operations only after the PHP module loads. All of this lets it blend into legitimate processes while delivering remote shell functionality.
Indicators & What To Inspect
To detect the compromise, administrators should look for:
- A matching SHA-256 hash:
26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9. - Names of three web-top scripts targeted for injection:
apm_css.php3,full_wt.php3, andwebtop_popup_css.php3. - A request prefix
BSOHAzPBmarking web shell traffic, and a runtime keywSLjN1beuRused by the embedded shell. - A Unix socket at
/run/bigtlog.pipe, tied to an authentication tokenKzwd6jM5that leads to Bash shell access. - File paths showing infection:
/usr/sbin/httpd, plus signs of tampering in BIG-IP upgrade image workflows (/mnt/tm_install), and memory reads around/proc/self/maps, among others.
Experts recommend immediately preserving volatile data—memory dumps, running process lists—before changing anything on the compromised host. They suggest monitoring Apache workers for memory map access, temporary write-and-execute modifications in libphp, discovery of unexpected local sockets, and child processes spawning Bash.
Remediation should follow F5’s official guidance for affected APM versions rather than applying catch-all fixes to Apache or PHP that may overlook device-specific intricacies. When feasible, disable legacy PHP execution, compare memory contents against files on disk, and check if any PHP endpoints unexpectedly return CSS files with 201 responses. Also verify upgrade images and examine SELinux configuration changes since these can be manipulated for persistence beyond a simple service restart.
This rootkit marks a shift in how attackers are targeting critical infrastructure. By avoiding written file artifacts and operating entirely in memory (and embedding within trusted processes like Apache/libphp), it outwits standard detection tools. Organizations using BIG-IP APM must act now—not only to patch but to enhance detection around runtime behaviors, authentication tokens, and server responses masquerading as innocuous assets.
What this means going forward is a harder truth for cybersecurity: fileless attacks are becoming more sophisticated, especially against high-value targets like F5 APM appliances. The blend of in-memory web shells, stealthy backdoors, and persistence across upgrades shows that defenders need to shift from reactive patching to proactive behavioral analysis. Monitoring runtime activity—process injections, socket creations, unexpected HTTP behaviors—will be as vital as keeping systems fully patched. Keeping an eye on these advanced indicators could make all the difference.
