PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory-Only PHP Web Shells

CVE-2025-53521 is an unauthenticated remote code execution in F5 BIG-IP APM that is reachable when an access policy is configured on a virtual server, a stack-based buffer overflow (CWE-121) in the apmd process on the data plane. F5 shipped the fix on October 15, 2025 but categorized the bug as denial of service at CVSS 7.5, and only re-rated it as critical RCE at 9.8 in March 2026 once exploitation came to light through an investigation credited to Schuberg Philis, Fox-IT, and the Dutch NCSC. The implant behind campaign c05d5254, dubbed PoisonedRefresh by ESET, is a userland rootkit: a umount-based installer prepends a malicious ELF to /usr/sbin/httpd and /usr/bin/umount, the payload hooks __libc_start_main and the APR module loader apr_dso_load, and then injects a PHP web shell into the mmap() view of apm_css.php3, full_wt.php3, and webtop_popup_css.php3 so commands execute from memory while the disk files stay byte-for-byte clean.

The argument that matters here is that patching does not close this incident. F5's IOC guidance instructs any customer that ran a vulnerable APM version at any point to scan for compromise regardless of current version, because the installer infects rc.local, umount, and httpd inside the BIG-IP install media, so an upgraded box can still be running a backdoored httpd. That matters disproportionately because the compromised component is an edge access gateway: APM decides VPN and webtop access for everyone behind it, and the implant pairs the memory-only shell with a local UNIX socket at /run/bigtlog.pipe that authenticates and hands its streams directly to /bin/bash, meaning attacker code runs inside the device that arbitrates remote access. The timeline is the other reason this story outranks routine KEV noise: CISA set a March 30, 2026 remediation deadline, yet the deep technical analysis from Sophos and ESET only surfaced on September 7, 2026, leaving about five months in which a fully patched appliance could still harbor an implant that disk checks would miss.

Remediation starts with the branch fixes 15.1.10.8, 16.1.6.1, 17.1.3, and 17.5.1.3, followed by the F5 System Scanner (K000160515) rather than a reboot; treat hash, size, or timestamp mismatches on /usr/bin/umount, /usr/sbin/httpd, /usr/sbin/chroot, /usr/libexec/apmd64, /usr/bin/sys-icheck, /usr/libexec/sys-eicheck.py, or /etc/rc.d/rc.local as compromise and escalate per K11438344, and rebuild configuration from a known good source instead of restoring UCS archives taken from a suspect system. On the host, verify getenforce returns Enforcing, confirm /config/startup holds only authorized changes, and search /var/log/auditd/audit.log for setenforce 0 and /var/log/restjavad-audit for f5hubblelcdadmin POSTs to http://localhost:8100/mgmt/tm/util/bash. On the wire, hunt POSTs to the .php3 webtop endpoints whose bodies carry the BSOHAzPB magic prefix and return HTTP 201 with Content-Type text/css, and on the box check for creation of /run/bigtlog.pipe or /run/bigstart.ltm, and flag Apache workers reading /proc/self/maps, RWX-to-RX permission flips around libphp, or httpd lineage spawning /bin/bash; Sophos detects the analyzed sample (SHA-256 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9) as Linux/Agnt-IC and ESET has published installer hashes.

Two developments would change this assessment. A further revision of K000160486 adding files beyond the seven currently listed would widen the compromise perimeter, since K000160486 was already updated once on April 3, 2026 and F5 has observed cases of web shells written to disk. Evidence that the umount installer propagates laterally between BIG-IP systems on its own, rather than persisting only through infected install media, would convert isolated compromises into fleet-wide ones and justify treating every internet-exposed APM deployment from the vulnerable window as presumed compromised.