As reported by SecurityAffairs, SophosLabs has published a detailed technical analysis of a stealthy Linux implant—dubbed PoisonedRefresh by ESET and tracked by Sophos as Linux/Agnt-IC—that injects PHP web shells directly into the memory of Apache processes running on F5 BIG-IP Access Policy Manager (APM) servers. This is not run-of-the-mill appliance compromise; it represents a purpose-built, environment-aware rootkit designed to vanish into the host while surviving firmware upgrades.
The initial access vector is CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM. F5 has confirmed active exploitation and links the campaign to an internal cluster it tracks as c05d5254. Notably, this vulnerability was initially classified as a denial-of-service issue before being elevated to RCE—a classification drift that likely cost defenders critical patching lead time. At disclosure, The Shadowserver Foundation identified 795 internet-exposed endpoints still vulnerable.
Vulnerability Profile
| Field | Detail |
|---|---|
| CVE | CVE-2025-53521 |
| Type | Unauthenticated Remote Code Execution |
| Severity | Critical (RCE, no auth required) |
| Affected Product | F5 BIG-IP Access Policy Manager (APM) |
| Affected Configuration | Access policy configured on a virtual server |
| Exploitation Status | Confirmed active in the wild (F5 cluster c05d5254) |
| Patch / Remediation | F5 has issued remediation and compromise-assessment guidance |
| Exposed Endpoints at Disclosure | ~795 (Shadowserver data) |
Why This Matters: Engineering Beyond Detection
What sets PoisonedRefresh apart from typical post-exploitation tooling is the degree to which it was engineered specifically for the BIG-IP APM environment—and specifically to defeat the forensic techniques defenders rely on. The malware is deployed in two stages, each addressing a different operational need.
The first stage hides inside a modified Linux umount binary, infects /usr/sbin/httpd, tampers with SELinux configuration to reduce security posture, and—most critically—embeds itself into BIG-IP upgrade images. This last step means that even a full firmware upgrade, often recommended as a remediation step for compromised appliances, may not eradicate the implant. Defenders who assume "patch and upgrade" is sufficient are operating on a false premise.
The second stage is a standalone ELF binary that ships with its own loader rather than relying on the system's dynamic linker. By intercepting __libc_start_main, the malware executes its setup routine before Apache's main function runs, before logging daemons are fully initialized, and before some security monitoring tools attach to the process. Operational strings are RC4-encrypted, and the PHP web shell payload is injected into Apache's memory space with no corresponding disk artifact. There is no file to find with a filesystem scan.
The combination of in-memory execution, custom loader, pre-main interception, and upgrade-image persistence creates a detection surface that is vanishingly small using conventional host-based tooling.
Who Is at Risk
- Organizations running F5 BIG-IP APM with access policies bound to virtual servers—especially those exposed to the internet.
- Enterprises that have not yet applied F5's remediation guidance for CVE-2025-53521, including those who delayed patching based on the initial DoS classification.
- Environments relying on disk-based antivirus or file integrity monitoring as the primary detection layer for appliance compromise—these tools will not see PoisonedRefresh.
- Organizations that upgraded BIG-IP firmware after potential exposure, since the implant may have survived the upgrade cycle.
Shield53 Recommendations
- Follow F5's compromise-assessment guidance first—do not jump straight to generic Apache/PHP hardening. F5's remediation steps are environment-specific and account for the persistence mechanisms described.
- Patch CVE-2025-53521 immediately on all BIG-IP APM instances, prioritizing internet-facing virtual servers with access policies configured. Treat this as a critical-severity RCE regardless of any prior DoS classification.
- Assume upgrade is not remediation. If a system was exposed during the vulnerability window, perform a full rebuild from a known-good image rather than relying on an in-place upgrade to clear persistence.
- Deploy memory-based detection—look for unexpected ELF processes with custom loaders, anomalous
__libc_start_mainhooking behavior, and PHP execution contexts within Apache that lack corresponding filesystem paths. - Audit SELinux configurations on BIG-IP appliances for unauthorized modifications, particularly permissive mode changes or policy exceptions introduced outside of legitimate maintenance windows.
- Monitor outbound network connections from BIG-IP management planes and APM worker processes. In-memory web shells still require command-and-control channels that may be visible at the network layer even when host artifacts are absent.
- Validate the integrity of upgrade images stored on or downloaded by BIG-IP systems. Compare hashes against F5's official checksums before any future upgrade cycle.
PoisonedRefresh is a reminder that appliance-level compromise has matured well beyond opportunistic exploitation. The threat actor behind cluster c05d5254 invested in environment-specific persistence, anti-forensic engineering, and survival across administrative actions that defenders typically trust. For organizations running BIG-IP APM, the window between "vulnerable" and "clean" is no longer closed by a patch alone—it requires verified eradication.
