Hackers are targeting F5 BIG-IP Access Policy Manager (APM) devices with a Linux rootkit that can hide a web shell inside running Apache processes.
Security researchers at Sophos analyzed the malware, named “PoisonedRefresh” by ESET researchers who discovered the threat on VitusTotal in April of this year.
The implant appears to be a second-stage payload deployed after attackers exploited a critical RCE flaw (CVE-2025-53521) affecting F5 BIG-IP systems.
The malware infects the Apache /usr/sbin/httpd executable and uses several advanced techniques to avoid detection. It intercepts __libc_start_main to run before the application’s main() function and hooks Apache’s apr_dso_load function to target the PHP module.
The rootkit then intercepts PHP file operations and injects a web shell directly into memory. It targets legitimate .php3 files commonly found in BIG-IP APM webtop environments, including apm_css.php3, full_wt.php3, and webtop_popup_css.php3. The original files on disk are not modified, making traditional file-based detection harder.
“This sample is a good example: rather than dropping a conventional web shell in the usual way, it modifies how specific PHP files are presented to the running process at runtime. While the capability exposed to the attacker is similar to that of a traditional web shell, the implementation removes many of the artifacts defenders typically rely on,” Sophos said.
The web shell accepts specially formatted requests, decrypts the data, and executes PHP code through eval(). It returns the results using an HTTP 201 response disguised as CSS content.
The malware also creates a password-protected Unix socket that can provide attackers with an interactive Bash shell without opening a network port. Notably, the backdoor is not created until Apache is running as usual, reducing the chance of crashing the service or attracting attention.
“Rather than spawn threads or heavy routines during early startup, the implant uses its hook on apr_time_now as a delayed trigger,” researchers explained. “When the Apache process begins making routine time calls, the implant spawns and detaches the worker thread responsible for creating the local UNIX socket backdoor. This timing minimizes the risk of destabilizing the service and helps the implant blend into normal runtime behavior. It also complicates dynamic analysis environments that only observe a brief window after process start.”
Sophos recommends to check for suspicious Apache activity, including access to /proc/self/maps, changes to libphp memory protections, creation of /run/bigtlog.pipe, and unexpected launches of /bin/bash. Defenders should also investigate unusual POST requests to the targeted .php3 files and PHP responses that return HTTP 201 with a text/css content type.