F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7.

When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy held in memory, so a check of the file on disk can come back clean. Those three scripts are the same ones F5 pointed customers to in March, when it said changes to them alone do not show a break-in.

A web shell is usually a small script an attacker drops into a web server's folders to run commands through ordinary web requests. Because it sits on disk, defenders look for it by scanning files and comparing them against known-good copies.

That approach does not work here. As the researchers put it, the web shell "does not need to exist in its final form on disk."

The three scripts are apm_css.php3, full_wt.php3 and webtop_popup_css.php3, part of the BIG-IP APM webtop. F5 named all three in March in a published list of indicators of compromise for the malware it tracks as c05d5254, and said at the time that their presence alone does not point to a security problem.

F5 also said it had seen cases where a web shell was written to disk, but that the web shells "have been observed to work in memory only," which means the files it listed might not be modified. The Sophos analysis explains how both statements can be true at once.

Sophos examined a single sample. Its analysis names no victim and does not say how the sample was obtained.

F5 has linked the c05d5254 activity to appliances affected by CVE-2025-53521, Sophos said. F5 first published that flaw on October 15, 2025, as a denial-of-service problem.

On March 27, 2026, F5 said new information had led it to reclassify the flaw as remote code execution, and that it had been exploited. An attacker needs no login to use it, and F5 rates it 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0.

CISA added it to its Known Exploited Vulnerabilities catalog the same day, giving U.S. federal civilian agencies until March 30 to act.

The flaw applies where a BIG-IP APM access policy is set on a virtual server. The UK's National Cyber Security Center calls BIG-IP APM a common component, especially in large organizations. F5's advisory lists the affected and fixed releases.

The patch that fixes this is nearly a year old. Ireland's National Cyber Security Center said in a March 31 advisory that the patch released in October is still valid and will protect against exploitation.

The web shell is the last step in a longer chain, and the earlier steps do touch the disk. Sophos said a separate installer, found in a sample named umount, infects the Apache web server program at /usr/sbin/httpd by adding malicious code to the front of the real file. The size of that added code matches the payload carried inside the installer, which Sophos said strongly suggests the installer puts it there.

ESET, which analyzed related samples in April and named the malware PoisonedRefresh, said the installer is meant to be run as root and turns off SELinux. It also infects umount, httpd and rc.local inside BIG-IP install images, which ESET said was presumably done to spread the malware to other systems through the installation media.

Because the malware sits inside the Apache program, it runs before Apache's own code starts. Sophos said it hooks an Apache Portable Runtime function, apr_dso_load, and does nothing until Apache loads the PHP module, libphp.

Once PHP is loaded, the malware reads /proc/self/maps to find the module in memory, briefly makes those memory pages writable, rewrites the calls the module uses to open, size, and map files, then puts the original permissions back. From that point, it controls what PHP sees when it opens one of the three scripts. When the file is mapped into memory, the malware places the web shell in front of the original content.

The web shell reads the raw body of a request, checks it for a short marker, decrypts the rest, and runs it. It replies with HTTP status 201 and a CSS content type, so the exchange looks like a request for a stylesheet.

The malware also opens a local socket at /run/bigtlog.pipe. After checking for a fixed token, it connects that socket to /bin/bash, giving an interactive shell without opening a network port.

Sophos said it could not find any code in the sample for connecting to that socket, and no other use of the token, so the two ways in look like separate features. It has no evidence either way on whether the attacker reaches the socket through the web shell.

What Defenders Can Check

Sophos said its behavioral signals are leads to investigate, not proof on their own, and should be read alongside file, process, and memory evidence. The list below combines them with the indicators F5 published in March.

• File: /run/bigtlog.pipe or /run/bigstart.ltm present
• Binary: hash, size or timestamp mismatch on /usr/bin/umount or /usr/sbin/httpd against a known good copy. F5 notes that sizes and timestamps differ between releases and engineering hotfixes
• Tool: sys-eicheck failing because one of those two files has changed
• Log: an entry in /var/log/restjavad-audit showing a local user reaching the iControl REST API from localhost
• Log: an entry in /var/log/auditd showing SELinux being switched off by the same route
• Log: an entry in /var/log/audit showing a bash command run through iControl REST. F5 says these lines show base64 data written into a file and /run/bigstart.ltm being run
• Traffic: HTTP 201 responses carrying a CSS content type from the appliance
• Host behavior: an Apache worker reading /proc/self/maps, changing memory permissions around libphp, binding a socket under /run, or starting /bin/bash
• SHA-256: 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9
• File, weak on its own: changes to the three .php3 scripts. F5 says their presence alone does not show a problem, and the Sophos analysis explains why: the file does not have to change at all

F5's list also includes items the Sophos analysis does not cover, among them /run/bigstart.ltm and the changes affecting sys-eicheck. Neither account describes the whole intrusion.

If You Have Already Patched

Patching does not settle whether an appliance was compromised before the patch went on.

Ireland's NCSC said no timeline for exploitation is available, and that it expects some exploitation was or could have been happening before the flaw and its fix were first published in October 2025.

The UK's NCSC advises investigating for compromise "regardless of when the system was updated."

1. Run F5's built-in sys-eicheck integrity check. F5's own indicators say the changes to /usr/bin/umount and /usr/sbin/httpd make this tool fail, so a failure is itself the signal.
2. Collect a qkview report, send it to F5 and raise a case. Ireland's NCSC said F5 can check that report for signs of compromise, and that raising an associated case brings a quicker and fuller response.
3. Compare the contents of modules in memory against the copies on disk, which Sophos recommends adding to incident response playbooks for critical web servers.
4. Where a full investigation is not possible, the UK NCSC advises isolating the appliance and rebuilding it as new, and says this may cause an outage.

Three things are still unknown. F5 has not said when exploitation began.

None of the published advisories or analyses say whether upgrading an appliance to a fixed release removes malware already installed on it, and both Sophos and ESET describe a component designed to survive upgrade images.

And no one has named an attacker: Sophos said it does not have enough evidence to name a group, and ESET said in April that it had not settled the question either.