At a Glance Malware family Poisoned Refresh (Linux rootkit implant) Threat actor Unconfirmed (tracked by F5 as activity cluster c05d5254) Target or victims F5 BIG-IP Access Policy Management (APM) environments Delivery vector Exploitation of unauthenticated RCE flaw CVE-2025-53521 Key capabilities Custom ELF loader, memory patching, fileless PHP web shell, local UNIX socket shell Source SophosLabs, ESET, F5 Networks TL;DR Security researchers at SophosLabs analyzed a stealthy Linux implant targeting…