As reported by BleepingComputer, researchers at Sophos have published analysis of a sophisticated Linux rootkit targeting F5 BIG-IP APM (Access Policy Manager) environments — a payload ESET tracks as PoisonedRefresh. The implant demonstrates an alarming level of operational discipline: it hooks Apache's APR module loader, injects a PHP web shell directly into memory without touching disk, disguises C2 traffic as CSS content in HTTP 201 responses, and survives BIG-IP upgrade images by modifying SELinux configurations and the httpd binary itself.

Security Impact: It is a purpose-built, appliance-aware persistence framework designed to maintain deep access in mission-critical infrastructure that organizations are reluctant to reboot or rebuild.

This is not a opportunistic web shell drop. It is a purpose-built, appliance-aware persistence framework designed to maintain deep access in mission-critical infrastructure that organizations are reluctant to reboot or rebuild.

Vulnerability Details

FieldDetails
CVECVE-2025-53521
SeverityCritical (RCE — originally classified as DoS, reclassified by F5 in March 2026)
Affected ProductsF5 BIG-IP APM (Access Policy Manager) environments running vulnerable versions
VendorF5 Networks
Patch StatusPatch available — organizations should consult F5's security advisory for their specific BIG-IP version
Active ExploitationYes — Sophos confirms rootkit deployed in the wild as second-stage payload following CVE-2025-53521 exploitation
Threat ActorUnattributed at time of reporting

Why This Matters

F5 BIG-IP appliances sit at the network edge — they are the gatekeepers for authentication, traffic inspection, and application delivery in enterprises, financial institutions, and government agencies. A rootkit that persists across firmware upgrades and hooks into the Apache runtime at the APR loader level means traditional remediation — patching and rebooting — may not fully evict the attacker.

Several aspects of this attack warrant particular concern:

Why This Matters
Fileless in-memory injection — the web shell is injected into the in-memory copy of legitimate PHP scripts like apm_css.php3 and full_wt.php3. Files on disk remain unchanged, rendering file integrity monitoring (FIM) ineffective.
Upgrade persistence — modification of SELinux policy and the httpd binary means the implant survives BIG-IP image upgrades, a technique rarely seen in commodity malware.
Stealthy C2 — the web shell responds with HTTP 201 and CSS-disguised content, blending into expected APM webtop traffic patterns.
Initial vector reclassification — F5 originally classified CVE-2025-53521 as a denial-of-service issue before reclassifying it as RCE. This gap likely delayed patch urgency for many organizations.

The combination of edge appliance targeting, memory-only persistence, and upgrade survivability makes this one of the most concerning appliance-rootkit combinations we've seen in 2026. Organizations that treated the original CVE as a low-priority DoS issue are now facing potential long-term compromise.

Who Is at Risk

Any organization running F5 BIG-IP with APM provisioned — particularly those that have not yet applied patches for CVE-2025-53521 — should assume potential compromise. Highest-risk deployments include:

  • Enterprise environments using BIG-IP APM for VPN or web application access
  • Financial services and government agencies with internet-exposed BIG-IP management interfaces
  • Organizations that delayed patching due to the original DoS classification
  • Deployments where BIG-IP upgrades have been performed since March 2026 without integrity verification

Shield53 Recommendations

Immediate Actions

  • Patch now — Apply the F5 advisory fix for CVE-2025-53521 on all BIG-IP APM instances, prioritizing internet-exposed systems.
  • Assume compromise and hunt — File-based IOC scanning will miss this implant. Focus detection on:
    • Unexpected SELinux policy modifications on BIG-IP systems
    • Modified /usr/sbin/httpd binary (compare against known-good hash from F5 image)
    • Apache worker threads spawning detached UNIX socket listeners after startup
    • HTTP 201 responses with CSS content-type from APM webtop paths
  • Validate binary integrity — Run md5sum or sha256sum on /usr/sbin/httpd and compare against the hash from a clean BIG-IP image of the same version. Any mismatch indicates compromise.
  • Inspect SELinux state — Check for unauthorized policy modules: semodule -l and review /etc/selinux/ for unexpected modifications.
  • Monitor network egress — Look for outbound connections from BIG-IP management plane IPs that don't match expected F5 telemetry destinations.
  • Consider full rebuild — Given the upgrade persistence mechanism, patching alone may be insufficient for confirmed compromises. A clean reimage from a trusted BIG-IP ISO followed by restoration from known-clean configuration backups is the safest path.

Broader Defensive Posture

  • Review all edge appliances — not just F5 — for similar APR/Apache-based hooking techniques. This tradecraft is transferable.
  • Segment management interfaces. BIG-IP admin ports should never be directly internet-exposed.
  • Implement network-level behavioral detection for edge appliances: baseline normal APM traffic patterns and alert on deviations.
  • Treat all CVE reclassifications as potential scope expansions. When a vendor reclassifies severity, re-evaluate your patching SLA immediately.

This attack underscores a growing trend: threat actors are investing in appliance-specific malware that weaponizes the unique characteristics of infrastructure devices — their persistence mechanisms, their trusted position, and the operational reluctance to take them offline. Defenders must treat edge appliances not just as network infrastructure but as high-value endpoints requiring the same detection and response rigor as crown-jewel servers.