PoisonedRefresh rootkit injects PHP web shells into F5 BIG-IP APM Apache memory, leaving no disk artifacts.

PoisonedRefresh rootkit injects PHP web shells into F5 BIG-IP APM Apache memory, leaving no disk artifacts. SophosLabs published a detailed technical analysis on September 8, 2026, of a Linux implant, dubbed PoisonedRefresh by ESET, they found in compromised F5 BIG-IP Access Policy Manager environments. Sophos tracks it as Linux/Agnt-IC. F5 has confirmed exploitation of the […]

PoisonedRefresh rootkit injects PHP web shells into F5 BIG-IP APM Apache memory, leaving no disk artifacts.

Sophos found a rootkit on compromised F5 BIG-IP APM devices that hides a web shell in memory instead of writing it to disk, making it harder for file-based security tools to detect. The campaign is linked to exploited F5 BIG-IP APM activity, including CVE-2025-53521, and uses staged malware with deeper Apache and PHP interception techniques. #F5BIGIPAPM #CVE202553521 #PoisonedRefresh

SophosはF5 BIG-IP APM侵害環境で、メモリ上へWebシェルを注入するLinuxルートキット「PoisonedRefresh」を解析。関連するCVE-2025-53521は未認証RCEとして実悪用済みで、CISA KEV掲載・JPCERT/CC注意喚起済みです。仕組み、対象バージョン、IOC、企業の対応を整理

Rootkit PoisonedRefresh compromete ambientes F5 BIG IP APM e injeta uma web shell diretamente na memória, dificultando a detecção tradicional.

Sophos found that malware tied to intrusions on F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory, allowing the infected files on disk to appear clean. The activity is linked to CVE-2025-53521 and the c05d5254 malware, with related reporting from F5 and ESET's PoisonedRefresh analysis. #F5 #BIG-IP...

PoisonedRefresh infects F5 BIG-IP APM servers by exploiting CVE-2025-53521 and hides its web shell exclusively in memory, leaving on-disk files untouched.

A sophisticated Linux implant linked to compromised F5 BIG-IP Access Policy Management (APM) environments.

F5 BIG-IP Access Policy Management(APM)環境の侵害に関連する、高度なLinuxインプラントが確認されました。 この攻撃活動は、仮想サーバーにアクセスポリシーが設定されている場合にBIG-IP APMに影響する未認証のリモートコード実行の脆弱性、CVE-2025-53521の悪用と

At a Glance Malware family Poisoned Refresh (Linux rootkit implant) Threat actor Unconfirmed (tracked by F5 as activity cluster c05d5254) Target or victims F5 BIG-IP Access Policy Management (APM) environments Delivery vector Exploitation of unauthenticated RCE flaw CVE-2025-53521 Key capabilities Custom ELF loader, memory patching, fileless PHP web shell, local UNIX socket shell Source SophosLabs, ESET, F5 Networks TL;DR Security researchers at SophosLabs analyzed a stealthy Linux implant targeting…