Linux rootkit targets F5 BIG-IP APM systems with fileless web shell injection
Sophos researchers analyzed a Linux rootkit that infects F5 BIG-IP APM devices, likely exploiting CVE-2025-53521. The malware intercepts PHP file loading and injects a fileless web shell into memory, avoiding disk writes. It achieves persistence across upgrade images and hides its operations using RC4 encryption.
The rootkit's installer modifies SELinux configurations and ensures persistence across BIG-IP upgrade images. It hooks the Apache Portable Runtime loader to intercept PHP operations, specifically targeting three webtop scripts. Because the malicious code remains entirely in memory, the original files on disk stay unchanged.
The implant waits for routine time calls before spawning a worker thread to create a password-protected local UNIX socket backdoor, avoiding TCP ports. This socket requires an existing foothold. ShadowServer's tracker indicates roughly 795 vulnerable endpoints were publicly reachable, highlighting the attack surface.
This stealthy rootkit could severely undermine the security of enterprises that depend on F5 BIG-IP APM for remote access. Since the malware operates entirely in memory and survives upgrades, it may allow attackers to maintain long-term, undetected presence within critical network perimeters. Affected organizations could face significant data breaches, service disruptions, and regulatory consequences, while the exposed endpoints suggest a substantial number of networks remain potentially vulnerable to such intrusions.