F5 BIG-IP APM Malware Hides Web Shell in Apache Memory to Evade Disk Scans

Security researchers have uncovered a sophisticated malware implant targeting F5 BIG-IP Access Policy Manager (APM) appliances that can conceal a PHP web shell entirely within Apache process memory, allowing attackers to maintain server-side code execution while leaving the targeted PHP files on disk unchanged.

Researchers at Sophos analyzed the malware and found that it intercepts Apache's handling of PHP modules and modifies the in-memory representation of legitimate BIG-IP APM webtop scripts. As a result, traditional file-integrity checks and disk-based malware scans can report the affected files as clean even though malicious code is being executed in memory.

The activity has been linked to compromises involving CVE-2025-53521, a critical F5 BIG-IP APM vulnerability that F5 reclassified from denial of service to unauthenticated remote code execution in March 2026 after confirming exploitation. The vulnerability carries a CVSS 3.1 score of 9.8.

The discovery is particularly concerning for enterprises because the malware combines rootkit-style process manipulation, memory injection, persistence mechanisms and a fileless web shell, creating multiple ways to evade conventional security controls.

Key Takeaways

• Sophos identified malware targeting F5 BIG-IP APM appliances.

• The malware injects a PHP web shell into Apache process memory.

• The malicious web shell does not need to exist in its final form on disk.

• Three legitimate BIG-IP APM PHP scripts are targeted:

  • apm_css.php3
  • full_wt.php3
  • webtop_popup_css.php3

• File-integrity monitoring may therefore fail to identify the active web shell.

• The malware modifies Apache and hooks its PHP-loading behavior.

• A separate local Unix socket can provide an interactive Bash shell without opening a network listening port.

• The activity has been linked to CVE-2025-53521, an unauthenticated RCE vulnerability in BIG-IP APM.

• ESET previously identified related malware as PoisonedRefresh.

• Sophos found evidence of additional persistence designed to survive BIG-IP upgrade workflows.

• Defenders should investigate compromised appliances even if they have already been patched.

The Malware Turns Apache Into the Attack Platform

The malware analyzed by Sophos is not a conventional PHP web shell simply dropped into a web directory.

Instead, it modifies the environment in which Apache executes PHP.

The implant is reportedly loaded before Apache's normal code begins executing and hooks the Apache Portable Runtime function apr_dso_load, allowing it to monitor when Apache loads the PHP module.

When PHP becomes available, the malware begins manipulating the module's memory and intercepting file operations.

This gives the attackers control over what PHP sees when it opens particular files.

The critical difference is that the malicious content does not have to be written back to those files.

How the In-Memory Web Shell Works

The attack can be summarized as a multi-stage process.

1. Apache Is Compromised

A separate installer component infects the Apache executable:

/usr/sbin/httpd

Sophos reported that the installer adds malicious code to the legitimate Apache binary.

This allows the implant to execute whenever Apache starts.

2. The Implant Hooks Apache

The malicious code intercepts Apache's module-loading process through:

apr_dso_load

The implant remains largely inactive until Apache loads the PHP module.

3. PHP Memory Is Modified

The malware examines:

/proc/self/maps

to locate the PHP module in memory.

It then temporarily changes memory permissions, modifies relevant function calls and restores the original permissions afterward.

4. Legitimate PHP Files Are Intercepted

The malware specifically watches for three BIG-IP APM webtop scripts:

apm_css.php3
full_wt.php3
webtop_popup_css.php3

When Apache opens these files, the implant intercepts the operation.

5. The Web Shell Is Added in Memory

When the PHP file is mapped into memory, the malware creates a modified in-memory representation containing the malicious web shell and the legitimate PHP content.

The original file on disk remains unchanged.

This is the key evasion mechanism.

A security scanner that only compares the three PHP files against known-good versions may therefore conclude that everything is normal.

Why Traditional File Scanning Can Fail

Traditional web-shell detection commonly relies on finding suspicious files.

For example:

Web server
     ↓
Scan web directory
     ↓
Compare PHP files
     ↓
Identify modified/malicious file

The F5 malware changes the equation:

Legitimate PHP file on disk
            ↓
       Apache loads it
            ↓
    Malware intercepts it
            ↓
 Malicious code injected into memory
            ↓
       Web shell executes

The malicious payload therefore exists in its final executable form only after the PHP content has been loaded into memory.

Sophos said this means the web shell does not need to exist in its final form on disk.

For defenders, this is a significant lesson:

A clean file does not necessarily mean a clean process.

The Web Shell Can Blend Into Normal Web Traffic

The implant's command channel is designed to resemble ordinary web activity.

The malicious PHP component examines the raw body of incoming HTTP requests for a specific marker.

It then decrypts the remaining content and executes it through PHP.

The response is returned with:

• HTTP status 201
• A CSS-related content type

This can make malicious communication appear similar to a normal request for web resources.

This behavior can complicate network-based detection when security teams are primarily looking for obvious command-and-control traffic.

A Second Backdoor Avoids Network Listening Ports

The malware also establishes another access mechanism using a Unix domain socket:

/run/bigtlog.pipe

After checking for a fixed token, the socket can be connected to:

/bin/bash

This provides an attacker with an interactive shell without requiring a traditional TCP listening port.

That distinction matters for network defenders.

A conventional backdoor may be detected by searching for:

External IP → Suspicious TCP Port

The Unix socket mechanism instead keeps communication local to the appliance:

Local socket
     ↓
Authentication token
     ↓
/bin/bash

Sophos said it did not find code in the analyzed sample that connected to the socket, so it could not determine whether the web shell was used to reach this second access mechanism.

Connection to CVE-2025-53521

The malware activity has been linked to CVE-2025-53521, a vulnerability affecting F5 BIG-IP APM environments.

F5 initially disclosed the issue in October 2025 as a denial-of-service vulnerability.

However, on March 27, 2026, F5 updated its assessment after receiving new information and classified the flaw as a remote code execution vulnerability that had been exploited.

The vulnerability does not require authentication and received:

• CVSS 3.1: 9.8
• CVSS 4.0: 9.3

CISA subsequently added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

This provides a plausible initial access route for the malware, although the full intrusion chain and attribution remain unresolved.

Affected BIG-IP Versions

F5's advisory identifies the following vulnerable release ranges where an APM access policy is configured on a virtual server:

Vulnerable Version	Fixed Version
BIG-IP 17.5.0 – 17.5.1	17.5.1.3
BIG-IP 17.1.0 – 17.1.2	17.1.3
BIG-IP 16.1.0 – 16.1.6	16.1.6.1
BIG-IP 15.1.0 – 15.1.10	15.1.10.8

The relevant fixes were released months before the current malware analysis. Security agencies have nevertheless warned organizations that patching alone does not prove an appliance was never compromised.

PoisonedRefresh and the Broader Malware Chain

ESET previously analyzed related samples and named the malware PoisonedRefresh.

The broader infection chain appears to involve more than the in-memory web shell.

A separate component identified as umount was found to infect:

/usr/sbin/httpd

Researchers also observed modifications involving:

umount
rc.local

and BIG-IP installation images.

ESET reported that the malware could modify SELinux configuration and potentially persist across upgrade workflows.

This creates an important incident-response concern: rebuilding or upgrading a compromised appliance may not be sufficient if the source installation image or persistence mechanism has also been compromised.

Indicators and Detection Opportunities

Sophos and F5 have identified several artifacts and behavioral indicators that defenders can investigate.

Suspicious Files

Check for:

/run/bigtlog.pipe
/run/bigstart.ltm

Modified System Binaries

Compare known-good versions of:

/usr/bin/umount
/usr/sbin/httpd

against the appliance.

Unexpected differences in:

• Hash
• File size
• Timestamp

should be investigated.

F5 notes that legitimate version and engineering-hotfix differences can affect these attributes, so they should not be treated as standalone proof of compromise.

Integrity Checking

F5's sys-eicheck integrity-checking mechanism can provide another useful signal.

A failure associated with modifications to relevant system binaries should trigger investigation.

Audit Logs

Review:

/var/log/restjavad-audit
/var/log/auditd
/var/log/audit

for suspicious activity involving:

• Local access to the iControl REST API
• SELinux being disabled
• Bash commands executed through iControl REST
• Base64-encoded data written to files
• Execution of /run/bigstart.ltm

Behavioral Indicators for SOC Teams

The following behaviors should receive particular attention:

Apache Reading /proc/self/maps

Unexpected Apache access to:

/proc/self/maps

can indicate attempts to inspect loaded modules and manipulate process memory.

Memory Permission Changes

Monitor for unusual changes to memory protections around:

libphp

especially when performed by Apache.

Apache Spawning Bash

An Apache worker unexpectedly launching:

/bin/bash

should be treated as a high-priority security event.

Unexpected Unix Socket Creation

Investigate creation or use of:

/run/bigtlog.pipe

Suspicious HTTP 201 Responses

Look for unusual HTTP 201 responses from BIG-IP web components accompanied by CSS content types and suspicious request bodies.

PHP Script Integrity Checks

The three targeted PHP files remain useful for investigation, but their presence or clean state should not be considered proof that the appliance is uncompromised.

Fileless Malware Changes the Incident-Response Playbook

This campaign highlights a broader challenge for network appliances.

Security teams often rely on endpoint-style methods such as:

• File integrity monitoring
• Antivirus scanning
• Hash comparison
• Malware signature detection

These remain valuable, but they are insufficient when malicious functionality is constructed dynamically inside a legitimate process.

For BIG-IP APM investigations, defenders should therefore expand their approach to include:

• Memory analysis
• Process integrity
• Runtime behavior
• System-call monitoring
• Apache process behavior
• Network traffic analysis
• Configuration integrity
• Installation-image integrity
• Historical authentication activity

What Organizations Should Do If They Have Already Patched

Patching CVE-2025-53521 is essential, but organizations should not assume that applying the update automatically removes an existing compromise.

Security teams should:

1. Run F5 Integrity Checks

Use sys-eicheck and investigate unexpected failures.

Collect a QKView

Generate a qkview diagnostic package and provide it to F5 for analysis where compromise is suspected.

3. Inspect the Appliance

Review:

• Apache binaries
• umount
• rc.local
• Cron and startup mechanisms
• /run/
• BIG-IP installation images
• Authentication logs
• iControl REST activity

4. Investigate Memory

Where available, perform memory analysis to determine whether Apache or PHP contains unexpected modifications.

This is especially important because the malicious web shell may not exist in its final form on disk.

5. Isolate When Necessary

If compromise cannot be ruled out, organizations should consider isolating the appliance and rebuilding it from a trusted source.

A rebuild should be performed carefully, particularly if there is evidence that upgrade or installation media may have been modified.

Threat Intelligence Snapshot

Indicator	Details
Target	F5 BIG-IP APM
Malware	c05d5254 / related PoisonedRefresh activity
Related vulnerability	CVE-2025-53521
Vulnerability severity	CVSS 3.1: 9.8
Primary technique	In-memory PHP web shell
Web server	Apache
Targeted PHP files	apm_css.php3, full_wt.php3, webtop_popup_css.php3
Local backdoor	/run/bigtlog.pipe
Shell	/bin/bash
Key evasion	Malicious content injected into memory
Confirmed exploitation	CVE-2025-53521 exploited
Public attacker attribution	Not established

Reported SHA-256

26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9

This hash should be incorporated into threat-hunting workflows alongside behavioral indicators rather than used as the sole detection mechanism.

Bottom Line

The latest F5 BIG-IP APM malware analysis demonstrates how attackers can bypass one of the most common assumptions in web-server security:

If the file is clean, the web shell must be gone.

In this case, that assumption does not hold.

The malware can intercept Apache's PHP processing and create a malicious web shell inside memory, while the corresponding PHP files on disk remain unchanged.

Combined with Apache binary modification, a local Bash backdoor and persistence mechanisms, the campaign represents a sophisticated threat to organizations relying on BIG-IP APM for critical access-control infrastructure.

Organizations running affected BIG-IP APM deployments should not stop at patching CVE-2025-53521. They should also perform compromise assessments, review system integrity, inspect runtime behavior and consider memory-level investigation.

For this threat, a clean disk is not necessarily a clean appliance.