Linux Rootkit Injects Fileless PHP Web Shells Into Compromised F5 BIG-IP Servers

A stealthy Linux rootkit is giving attackers a new way to keep control of compromised F5 BIG-IP Access Policy Manager servers.

Instead of leaving an obvious malicious PHP file behind, it places a web shell only in the memory used by the running server process. The activity is linked to BIG-IP APM webtop environments running Apache and PHP.

F5 has associated related activity with CVE-2025-53521, an exploited, unauthenticated remote-code-execution flaw, a risk already highlighted in coverage of exposed BIG-IP APM devices.

Sophos analysts identified the implant while examining compromised systems. The researchers said its design points to a targeted second-stage payload, rather than a broad attack against ordinary Apache or content-management installations, and noted no evidence sufficient to attribute it to a named threat actor.

The impact is serious because traditional file scans can show clean PHP scripts even while Apache executes altered versions in memory.

For a business using BIG-IP APM to provide remote access, that gap can give an intruder durable server-side control and a quiet route into protected infrastructure.

Sophos said in a report shared with Cyber Security News (CSN) that the implant combines a custom loader, process hooks and runtime patching to hide its operation.

Linux Rootkit Injects Fileless PHP Web Shells

The malware starts before the host program reaches its normal main function. It opens its own image, manually loads the original executable, and intercepts a core Linux startup routine.

That early foothold lets it set traps before normal Apache activity begins and makes conventional startup monitoring less reliable. It then watches Apache’s module loader and activates only when the PHP component, libphp, appears.

The implant changes selected file and memory operations inside that component, allowing it to control how particular scripts are opened and mapped. This selective behavior helps explain why it can remain hidden within a legitimate web service.

Three APM webtop scripts are the targets. When PHP maps one into memory, the rootkit builds a modified copy that contains the original content plus its web shell.

The file on disk remains unchanged, so checks based only on web-root files can miss the intrusion, unlike patterns seen in earlier BIG-IP RCE attacks. The injected code accepts specially formed requests, decrypts their contents and runs them on the server.

It returns an HTTP 201 response while presenting itself as a CSS resource, an unusual combination that may blend into ordinary asset traffic. That makes web logs, response headers and request patterns important evidence alongside filesystem checks.

Socket Backdoor Raises Response Stakes

The implant also creates a local Unix socket and can hand an authenticated connection to a Bash shell. Because this channel does not open a normal TCP listening port, network-only monitoring may not see it.

The finding adds context to reports of attackers using a BIG-IP appliance for SSH access and moving deeper into enterprise networks.

Researchers believe the rootkit is part of a staged operation. A related installer component appears to infect the HTTP server binary, preserve access through BIG-IP upgrade images, modify SELinux settings and deploy the runtime payload.

Restarting a service alone is therefore not a dependable recovery step, since it may not remove the earlier persistence mechanism.

Organizations that suspect compromise should preserve volatile evidence before changing the host, including process memory and running-process details.

They should investigate Apache workers reading process memory maps, temporary write-and-execute changes around libphp, unexpected local sockets, and child processes launching Bash.

Administrators should follow F5’s remediation and compromise-assessment guidance for affected APM versions before applying generic Apache or PHP changes.

Where operationally safe and reviewed, disabling unneeded legacy PHP execution can reduce exposure. Teams should also compare disk and memory content, inspect PHP endpoints returning CSS-labelled 201 responses, and use the latest BIG-IP patch guidance to prioritize corrective work.

They should also verify upgrade images and review SELinux changes, because persistence outside the live Apache process can survive a routine service restart.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.