F5 BIG-IP devices targeted by memory-resident Linux rootkit

Security researchers have identified a sophisticated Linux rootkit targeting F5 BIG-IP APM devices. The malware, which ESET has named ‘PoisonedRefresh’, utilizes advanced tradecraft to hide a web shell directly in memory rather than writing it to the disk, allowing it to evade traditional file-based scans of web directories.

The attack is linked to CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM that has been exploited in the wild. F5 has associated this activity with a specific cluster of attacks. The infection process involves a component named ‘umount’ that infects the Apache binary to ensure persistence across system upgrades and modifies SELinux configurations.

Sophos reported that the second-stage payload intercepts the Apache Portable Runtime (APR) module loader to inject the PHP web shell into memory. While the web shell itself remains invisible to web root scans, indicators of compromise include hash, size, or timestamp mismatches in specific system files such as the Apache binary and chroot. CISA has previously added the underlying vulnerability to its Known Exploited Vulnerabilities catalog.