A sophisticated Linux rootkit is enabling attackers to maintain control over compromised F5 BIG-IP Access Policy Manager (APM) servers. Rather than leaving behind a detectable malicious PHP file, the rootkit deploys a web shell directly into the server’s memory. This activity particularly affects BIG-IP APM webtop environments utilizing Apache and PHP.
Exploiting Known Vulnerabilities
The rootkit’s operations are linked to CVE-2025-53521, a known unauthenticated remote code execution vulnerability. This flaw has previously been highlighted in discussions about exposed BIG-IP APM devices. Analysts from Sophos discovered the implant during their investigation of compromised systems. They noted that its design suggests a targeted secondary payload rather than a widespread attack on typical Apache or content management systems.
The implications of this are severe. Traditional file scans often show clean PHP scripts even as Apache runs altered versions in memory. For businesses utilizing BIG-IP APM for remote access, this vulnerability offers intruders a persistent server-side control, potentially leading to unauthorized access to secure infrastructure.
Mechanism of the Rootkit
According to a Sophos report shared with Cyber Security News, the rootkit combines a custom loader, process hooks, and runtime patching to remain concealed. The malware activates before the host program reaches its usual main function, allowing it to intercept core Linux startup routines. This early intervention sets traps before normal Apache activity begins, rendering conventional monitoring methods less effective.
The rootkit specifically targets three APM webtop scripts. When PHP loads one of these scripts into memory, the rootkit creates a modified version containing both the original content and its web shell. This technique keeps the disk file unchanged, allowing the intrusion to go unnoticed by file-based scans. The injected code processes specially crafted requests and executes them on the server.
Advanced Stealth Techniques
The rootkit also establishes a local Unix socket for a backdoor channel, enabling an authenticated connection to a Bash shell. Because this channel does not use a standard TCP listening port, it can evade detection by network-only monitoring tools. This finding provides additional context to reports of attackers using BIG-IP appliances for SSH access, allowing them to penetrate deeper into enterprise networks.
Researchers believe the rootkit is part of a staged operation. An associated installer appears to infect the HTTP server binary, preserve access through BIG-IP upgrade images, alter SELinux settings, and deploy the runtime payload. Consequently, simply restarting a service is unlikely to remove this persistence mechanism.
Mitigation and Future Outlook
Organizations suspecting compromise should preserve volatile evidence before making changes to the affected host. This includes capturing process memory and running-process details. They should investigate Apache workers reading process memory maps, temporary write-and-execute modifications around libphp, unexpected local sockets, and child processes launching Bash.
Administrators are advised to follow F5’s guidance for remediation and compromise-assessment for affected APM versions before implementing generic Apache or PHP updates. Where feasible, disabling unnecessary legacy PHP execution can reduce exposure. Comparing disk and memory content, inspecting PHP endpoints returning CSS-labeled 201 responses, and utilizing the latest BIG-IP patch guidance are recommended steps for corrective action. Additionally, verifying upgrade images and reviewing SELinux changes are crucial, as persistence mechanisms can survive a routine service restart.
