Reported by 4 outlets

F5 BIG-IP APM rootkit deployed via CVE-2025-53521 exploitation

hot0.0

Why this score

Breadth: 2.00 / 2.0 · 4 sources
Authority: 1.80 / 2.0 · best outlet weight
Severity: 5.00 / 5.0 · CVSS + KEV signals
Velocity: 0.00 / 2.0 · updates in 48h
Pickup speed: 0.00 / 0.6 · time to second source
Recency: × 0.00 temporal multiplier
Community: + 0.00 / 1.5 · reddit signal
Score: 0.0 / 10 = base × recency + community

bleepingcomputer.commy.f5.comcisa.govsophos.com CVE-2025-53521 KEV desk first seen 35d ago

Desk analysis

A Linux userland rootkit named PoisonedRefresh by ESET has been recovered from compromised F5 BIG-IP APM systems, and Sophos X-Ops dissected the second stage on September 7, one day before this story surfaced. Delivery runs through CVE-2025-53521, an unauthenticated remote code execution in the apmd process that F5 remediated as denial of service at CVSS 7.5 on October 15, 2025, then re-rated critical RCE at 9.8 (CWE-121, stack-based buffer overflow) in March 2026 once exploitation surfaced. An installer observed as a malicious umount component prepends a 0x5430-byte payload to /usr/sbin/httpd, modifies SELinux configuration, and persists across BIG-IP upgrade images. The second stage hooks __libc_start_main so it runs before Apache's main(), waits via hooked apr_dso_load until libphp loads, then redirects open, mmap, and related calls inside libphp to prepend a PHP web shell to the in-memory copy of three APM webtop scripts, apm_css.php3, full_wt.php3, and webtop_popup_css.php3. Requests whose body carries the magic prefix BSOHAzPB are decrypted and executed through eval(), replies return HTTP 201 with a text/css content type, and a token-protected AF_UNIX socket at /run/bigtlog.pipe can hand its streams to /bin/bash with no listening TCP port.

The rating history is the operational trap. Teams that patched in the spring were hunting with the March picture: webshell checks on disk, log greps, and the F5 IoC list in K000160486 for activity c05d5254. PoisonedRefresh defeats exactly that, because the on-disk PHP files stay byte-for-byte clean while the shell exists only in libphp's memory view, the implant rides the upgrade images admins were told to apply, and the socket backdoor never touches the network stack. A device patched since October and declared clean by file-integrity tooling can still be serving a web shell from RAM. The scale is not marginal: Shadowserver counted over 240,000 BIG-IP instances exposed online when the reclassification landed, and its CVE-2025-53521 tracker still showed 795 vulnerable exposed endpoints on September 7. Each one is an identity gateway deciding who reaches the VPN and everything behind it, and the roughly six months between the March 27 KEV listing and the first public description of the implant means spring intrusions that skipped a memory-aware sweep may plausibly still be live.

Treat the branch fixes, 17.5.1.3 and 17.1.3 on 17.x, 16.1.6.1 on 16.x, and 15.1.10.8 on 15.x, as containment rather than eviction. F5 directs anyone who ran a vulnerable version, or upgraded from one, through IoC article K000160486 and compromise guidance K11438344, and warns that UCS backups taken after a compromise carry persistent malware, so capture volatile evidence first, then rebuild configuration from a known-good source instead of restoring archives, noting that restarting Apache destroys the in-memory shell and resets nothing else. On the host, hunt for creation of /run/bigtlog.pipe, Apache workers reading /proc/self/maps, RWX-then-RX permission flips around libphp, and httpd lineage spawning /bin/bash. On the wire, flag rare POSTs to the .php3 webtop endpoints and PHP replies pairing HTTP 201 with a text/css content type. Match systems against Sophos sample SHA-256 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9, detected as Linux/Agnt-IC, and ESET's SHA-1s E5066C2490197FFBE0E916BC232114A61CB09A16 and 7A2FC3510B502D8FDC2548F907AF08308840851C.

Two developments would change the read. Attribution first: F5 tracks the activity only as c05d5254 with no actor named, and Sophos found no client component that authenticates to the socket with the Kzwd6jM5 token, so a report identifying the operator-side tooling would confirm the backdoor works end to end and sharpen the victim profile. Tracker movement second: a rise above the 795 baseline in Shadowserver's series, or a revision of K000160486 listing artifacts beyond the umount and httpd components, would indicate a renewed or wider deployment window and force another memory-aware sweep of already-patched estates.

Timeline

original reporting

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit https:// bleepingcomputer.com/news/security/ hackers-breach-f5-big-ip-apm-devic

www.bleepingcomputer.com · 35d ago · September 8th, 2026

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit https:// bleepingcomputer.com/news/security/ hackers-breach-f5-big-ip-apm-devic

via X https://www.bleepingcomputer.com/news/security/hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit/
update from f5.com

K000156741: BIG-IP APM vulnerability CVE-2025-53521

f5.com · 364d ago · October 15th, 2025

F5's advisory, page shows Published Date Oct 15, 2025 and Updated Date Apr 1, 2026. Originally categorized and remediated as a DoS flaw at CVSS 7.5 (v3.1) / 8.7 (v4.0), it was re-categorized in March 2026 to an unauthenticated RCE in the apmd process, CWE-121 stack-based buffer overflow, internal ID 1977933, at CVSS 9.8 (v3.1) / 9.3 (v4.0), exploited in the wild and also affecting Appliance mode. It lists fixes 17.5.1.3 and 17.1.3 (17.x), 16.1.6.1 (16.x), and 15.1.10.8 (15.x), points to IoC article K000160486 for activity c05d5254 and compromise guidance K11438344, and warns that UCS backups taken after a compromise can contain persistent malware.
update from cisa.gov

CISA Adds One Known Exploited Vulnerability to Catalog

cisa.gov · 201d ago · March 27th, 2026

CISA alert with release date March 27, 2026 adding CVE-2025-53521, F5 BIG-IP Remote Code Execution Vulnerability, to the KEV Catalog based on evidence of active exploitation. Under BOD 22-01 it set a remediation deadline for FCEB agencies of midnight Monday March 30, 2026, the earliest government acknowledgment that the flaw was being exploited.
update from bleepingcomputer.com

Hackers exploiting critical F5 BIG-IP flaw in attacks, patch now

bleepingcomputer.com · 197d ago · March 30th, 2026

First coverage of the reclassification, by Sergiu Gatlan, March 30, 2026 06:59 AM ET. It reports F5's advisory update published the previous Sunday confirming attackers exploit CVE-2025-53521 to deploy webshells on unpatched devices, with IoCs in article K000160486 and checks of disks, logs, and terminal history recommended. Shadowserver at the time tracked over 240,000 BIG-IP instances exposed online, and CISA had KEV-listed the bug on Friday March 27 with a March 30 federal deadline.
update from sophos.com

Dissecting a PHP web server rootkit

sophos.com · 37d ago · September 7th, 2026

Sophos X-Ops technical analysis by Luke Mitchell dated September 7, 2026 on the Sophos Threat Research listing (first Wayback capture 2026-09-07T19:54:18Z), one day before the story's first event. It details the second-stage implant: RC4-hidden strings with key TrswBWIl90Z5e38n, interception of __libc_start_main, hooking of apr_dso_load and apr_time_now, mmap-level injection of a web shell using magic prefix BSOHAzPB into apm_css.php3, full_wt.php3, and webtop_popup_css.php3, HTTP 201 with text/css replies, an authenticated AF_UNIX backdoor at /run/bigtlog.pipe with token Kzwd6jM5 handing stdio to /bin/bash, an umount installer with a 0x5430-byte prefix persisting across upgrade images, detection as Linux/Agnt-IC, and sample SHA256 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9.
update from bleepingcomputer.com

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

bleepingcomputer.com · 35d ago · September 8th, 2026

A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk. The malware shows signs of being a second-stage payload that was likely deployed after exploiting CVE-2025-53521, a critical remote code execution (RCE) flaw that F5 Networks reclassified from a DoS problem in March. Sophos researchers analyzed a sample and noted that, while it enables “on-demand server-side code execution” typically associated with webshells, it achieves this through “deeper Linux- and Apache-specific tradecraft.” During the research, Sophos learned that the same malware was analyzed by ESET, who identifies it as ‘ PoisonedRefresh .’ In technical analysis published this week, Sophos says that the payload was deployed by a distinct installer or propagation component that had infected the Apache /usr/sbin/httpd executable used on BIG-IP APM systems. The malicious installer also modified SELinux configurations and achieved persistence across BIG-IP upgrade images, Sophos researchers say. "The second-stage sample hides key operational strings with RC4, gains execution before the host application main() function is invoked by intercepting __libc_start_main, targets Apache’s PHP module by hooking the Apache Portable Runtime (APR) module loader (apr_dso_load), and injects a PHP web shell into memory." The rootkit starts with Apache, with the second-stage implant interc
mentioned by www.bleepingcomputer.com

🤖 Linux rootkit 'PoisonedRefresh' hits F5 BIG-IP APM via CVE-2025-53521, a critical RCE initially rated as DoS. It intercepts __libc_start_m

www.bleepingcomputer.com · 35d ago · September 8th, 2026
mentioned by www.bleepingcomputer.com

🤖 Linux rootkit targets F5 BIG-IP APM: attackers intercept PHP file loading to inject a fileless web shell directly into memory — nothing wr

www.bleepingcomputer.com · 34d ago · September 9th, 2026