F5 BIG-IP APM Malware Hides PHP Web Shell in Memory

Malware Overview

Recent findings by Sophos have identified a sophisticated malware targeting F5 BIG-IP Access Policy Manager (APM) appliances. This malware operates by embedding a PHP web shell directly into memory, bypassing traditional disk-based detection methods. This tactic allows the malware to evade standard security checks, as highlighted in Sophos’s analysis dated September 7.

In-Memory Web Shell Execution

The malware leverages Apache’s process of loading PHP scripts by injecting the web shell into the memory, rather than storing it on disk. This method makes detecting the compromise challenging, as file-based scans return clean results. The compromised scripts include apm_css.php3, full_wt.php3, and webtop_popup_css.php3, which were previously identified by F5 in March as potential indicators of compromise.

Implications of the Malware

F5 initially identified the related activity as c05d5254, linking it to a vulnerability tracked as CVE-2025-53521. This flaw, originally classified as a denial-of-service issue, was later reclassified as a remote code execution vulnerability, with a critical CVSS score of 9.8. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) quickly added the vulnerability to its Known Exploited Vulnerabilities catalog, emphasizing its severity.

Organizations utilizing BIG-IP APM, particularly within large infrastructures, are significantly affected due to the widespread use of this component. The UK’s National Cyber Security Center has underscored the commonality of BIG-IP APM in such environments, necessitating vigilant monitoring and patching practices.

Technical Details and Defense Strategies

The malware’s final payload is deployed after exploiting an installation program that infects Apache’s HTTP daemon. This approach involves modifying memory permissions to introduce malicious elements before restoring original access rights, ensuring stealth operation. The web shell executes commands by interpreting specific HTTP requests, disguising its activity as legitimate traffic.

Defenders are advised to investigate behavioral indicators, such as abnormal Apache process activities and discrepancies in binary file attributes, to identify potential compromises. Specific anomalies, like HTTP status 201 responses with CSS content types, may indicate malicious activity.

Recommendations and Future Outlook

Security experts recommend conducting thorough integrity checks using tools like F5’s sys-eicheck and submitting qkview reports for analysis by F5. Organizations should also consider isolating and rebuilding compromised appliances to ensure a clean environment. The National Cyber Security Centers of Ireland and the UK stress the importance of these measures, even in the absence of direct evidence of exploitation.

While the exact timeline of exploitation remains unclear, proactive monitoring and incident response protocols are crucial. The persistence of malware components through system upgrades poses additional challenges, necessitating ongoing vigilance. As investigations continue, identifying the responsible attackers and understanding the full scope of the threat are priorities for cybersecurity experts.