Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Recorded: Sept. 8, 2026, 8:01 p.m.
| Original | Summarized |
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit News Featured Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days Adobe fixes critical Magento zero-day exploited to backdoor servers ShinyHunters hackers claim breach of Florida "DAVID" DMV database August updates trigger 0xc0000409 errors on Windows Server 2016 Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit Microsoft releases Windows 10 KB5122878 extended security update Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days Get an intro to the CISSP exam's 8 domains for $14.97 in this deal Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityHackers breach F5 BIG-IP APM devices to deploy Linux rootkit Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit By Bill Toulas September 8, 2026 A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk. Rootkit injecting the web shell into a PHP script’s in-memory copySource: Sophos Launching Bash through the local UNIX socketSource: Sophos Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Upcoming Webinar Popular Stories OpenAI admits it didn't disclose rogue AI wiki hijacking incident BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain Sponsor Posts See how attackers exploit passkey enrollment, and why hardware-bound biometrics raise enterprise identity assurance. CTI Starter Kit + 2026 SANS CTI Survey Unify ransomware protection and recovery for every client Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Hackers have successfully exploited vulnerabilities in F5 BIG-IP APM devices to deploy a Linux rootkit capable of establishing a fileless web shell, demonstrating sophisticated post-exploitation techniques. This malware functions as a second-stage payload, likely deployed subsequent to an initial Remote Code Execution flaw, specifically CVE-2025-53521, which F5 Networks recently reclassified from a Denial of Service issue. Research by Sophos and ESET identified the malicious sample, which they named PoisonedRefresh, analyzing how it leverages deeper Linux and Apache-specific techniques to achieve code execution within the environment. The method employed involves modifying core system components to inject code directly into memory without writing malicious files to disk. The rootkit achieves this by targeting the Apache /usr/sbin/httpd executable used on BIG-IP APM systems. The malicious installer modified SELinux configurations and ensured persistence across subsequent BIG-IP upgrade images. Technically, the implant hooks execution flow by intercepting the Apache Portable Runtime (APR) module loader, specifically the apr_dso_load function, and also targets the __libc_start_main function to gain control before the host application's main function is invoked. This allows the payload to fully hijack the process memory. Following initial code execution, the rootkit intercepts PHP file operations and modifies them in memory to conceal a web shell within legitimate scripts, such as apm_css.php3, full_wt.php3, and webtop_popup_css.php3. This manipulation ensures that the actual files on disk remain unchanged, which significantly reduces the surface area for traditional file-based detection. The injected webshell functions by accepting specific "magic" requests, decrypting their contents, executing them through PHP's eval() function, and returning an HTTP 201 response disguised as CSS content. To evade immediate detection upon system startup, the rootkit incorporates a protective mechanism that delays creating the local UNIX socket backdoor until the Apache process begins routine time calls, thereby blending the implant into normal runtime behavior and minimizing service disruption risk. Furthermore, the malware establishes a password-protected local communication socket that enables an interactive Bash shell without exposing a listening port to the internet; access to this socket would require an attacker to already have another foothold on the device. Defenders are advised to investigate specific indicators of compromise related to this activity. These signals include monitoring Apache workers for reading /proc/self/maps, changes in libphp memory protections, the creation of files like /run/bigtlog.pipe, or the execution of /bin/bash. Security personnel should also scrutinize unusual POST requests aimed at the .php3 endpoints and examine PHP responses that combine an HTTP 201 status code with a text/css content type. The ShadowServer Foundation reports that numerous F5 BIG-IP APM endpoints remain exposed, indicating ongoing risk associated with this vulnerability. |