A sophisticated Linux implant linked to compromised F5 BIG-IP Access Policy Management (APM) environments.
The activity has been associated with exploitation of CVE-2025-53521, an unauthenticated remote code execution flaw affecting BIG-IP APM when an access policy is configured on a virtual server.
F5 has confirmed exploitation of the vulnerability and links the related compromise activity to the c05d5254 campaign.
Traditional web shells are normally small PHP, JSP, or ASP scripts dropped into a web-accessible directory.
That model gives defenders tangible artifacts to hunt: modified files, unexpected scripts, suspicious POST parameters, and altered hashes.
PoisonedRefresh changes that equation. The implant intercepts file and memory operations inside Apache’s PHP module, libphp, and injects a malicious PHP payload into the in-memory view of selected scripts during mmap() operations.
The original files remain benign on disk, while the Apache worker process executes an altered version in memory.
Sophos observed the malware targeting BIG-IP APM webtop files including apm_css.php3, full_wt.php3, and webtop_popup_css.php3.
The injected payload reads raw data from php://input, checks for a magic request prefix, decrypts the remaining content, and executes it with PHP’s eval function.
It responds with HTTP 201 and Content-Type: text/css; charset=utf-8, helping malicious command traffic blend into apparently normal CSS-related requests.
The binary is stripped and statically linked, with operational strings encrypted using RC4.
Instead of following the normal Linux process startup sequence, the implant launches a custom ELF loader, reopens itself through /proc/self/exe, maps an embedded original executable into memory, and redirects execution through a wrapper around __libc_start_main.
This gives PoisonedRefresh control before the host application reaches its normal main() function.
SophosLabs said in a report shared with GBhackers, the malware turns Apache/PHP processes into stealthy backdoors by injecting a PHP web shell directly into memory, leaving the legitimate PHP files on disk unchanged.
The early execution point enables the malware to resolve APIs, decrypt strings, inspect process memory, and install hooks before Apache begins handling requests.
PoisonedRefresh Malware
After startup, the implant hooks Apache Portable Runtime functions, particularly apr_dso_load, to wait for Apache to load libphp.
It then locates the PHP module through /proc/self/maps, temporarily changes memory protections, patches relocation or call targets, and restores protections after modifying execution flow.
The resulting hooks intercept APIs such as open, close, mmap, and __fxstat, allowing the malware to control how selected PHP files are opened, sized, and mapped.
PoisonedRefresh also provides a second access path through a UNIX domain socket at /run/bigtlog.pipe.
Rather than exposing a TCP listener that could be found through conventional network scans, the implant waits for activity in the hooked apr_time_now function, launches a background worker, and binds the local socket.
Following authentication, the malware redirects standard input, output, and error streams to the socket before executing /bin/bash.
This creates an interactive local shell while allowing the backdoor to continue accepting additional connections through forked child processes.
The dual design gives attackers both HTTP-driven code execution and local interactive access.
Sophos detects the implant as Linux/Agnt-IC; the analyzed sample has SHA-256 hash 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9.
Organizations operating BIG-IP APM should first follow F5’s remediation and compromise-assessment guidance for CVE-2025-53521 rather than relying solely on generic Apache hardening.
The flaw affects vulnerable BIG-IP APM versions across the 15.1.x, 16.1.x, 17.1.x, and 17.5.x branches, with patched releases including 15.1.10.8, 16.1.6.1, 17.1.3, and 17.5.1.3.
Defenders should correlate several signals: Apache workers reading /proc/self/maps; memory permissions changing from writable and executable back to executable around libphp; creation of /run/bigtlog.pipe.
Apache-related processes launching /bin/bash; and unexpected POST traffic to targeted .php3 pages returning HTTP 201 with a CSS content type.
The case illustrates why disk-centric web-shell hunting is no longer sufficient. In a PoisonedRefresh compromise, filesystem inspection can show clean PHP scripts while memory, process behavior, and HTTP telemetry reveal an active backdoor.
★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
