Linux Rootkit Hides Fileless PHP Web Shells in F5 BIG-IP Server Memory
A sophisticated Linux rootkit is targeting F5 BIG-IP Access Policy Manager servers, injecting fileless PHP web shells directly into server memory to maintain persistent access.
A stealthy Linux rootkit is giving attackers a new way to maintain control over compromised F5 BIG-IP Access Policy Manager servers. Instead of leaving an obvious malicious PHP file on disk, this implant injects a web shell directly into the memory space of the running server process, making it significantly harder to detect using traditional file-based scanning methods. The activity has been observed in BIG-IP APM webtop environments that utilize Apache and PHP.
This exploit is linked to CVE-2025-53521, a critical unauthenticated remote-code-execution (RCE) vulnerability that has previously been highlighted in discussions about exposed BIG-IP APM devices. Sophos analysts discovered the implant while investigating compromised systems, noting that its design suggests a targeted second-stage payload rather than a broad, indiscriminate attack. While no specific threat actor has been definitively attributed to this activity, the impact is substantial, as the technique bypasses conventional file integrity checks that would otherwise flag a compromise.
The rootkit employs a sophisticated combination of a custom loader, process hooks, and runtime patching to conceal its operations. It initiates its execution before the host Apache program reaches its normal main function. By manually loading the original executable and intercepting core Linux startup routines, the implant establishes a foothold early in the boot process, allowing it to set up its malicious hooks before normal Apache activity begins. This makes conventional startup monitoring less effective in detecting its presence.
Once established, the rootkit monitors Apache's module loader and activates specifically when the PHP component, libphp, is loaded. It then selectively modifies file and memory operations within this component. This allows it to control how specific PHP scripts are opened and mapped into memory. The rootkit targets three specific APM webtop scripts. When PHP maps one of these scripts into memory, the rootkit constructs a modified version that includes the original script's content alongside its injected web shell.
The injected web shell is designed to accept specially crafted HTTP requests. Upon receiving such a request, it decrypts the contents and executes them on the compromised server. The implant returns an HTTP 201 response while masquerading as a CSS resource, an unusual combination that could potentially blend into normal web traffic patterns. This tactic necessitates careful examination of web logs, response headers, and request patterns in addition to filesystem checks for forensic analysis.
Beyond the in-memory web shell, the rootkit also establishes a local Unix socket, which can provide an authenticated connection to a Bash shell. This method of communication bypasses traditional network monitoring, as it does not open a standard TCP listening port. This finding aligns with previous reports of attackers using BIG-IP appliances for deeper network penetration.
Researchers believe this rootkit is part of a multi-stage attack. An associated installer component has been observed infecting the HTTP server binary, establishing persistence across BIG-IP upgrades, modifying SELinux settings, and deploying the runtime payload. Consequently, simply restarting the Apache service is insufficient for remediation, as it may not remove the underlying persistence mechanisms. Organizations suspecting compromise should prioritize preserving volatile evidence, such as process memory and running-process details, before making any changes to the affected host.