ShadowServer Foundation reported that 795 endpoints running F5 BIG-IP APM vulnerable to CVE-2025-53521 were exposed online yesterday.
CVE-2025-53521: the likely initial access vector
Sophos researchers who analyzed a Linux rootkit targeting BIG-IP APM environments concluded the payload appears to be a second-stage implant “likely deployed after exploiting CVE-2025-53521,” a critical remote code execution (RCE) flaw that F5 Networks reclassified from a denial-of-service issue in March. Sophos notes the implant enables what it calls “on-demand server-side code execution” but through “deeper Linux- and Apache-specific tradecraft” than a simple webshell.
How the implant operates inside Apache and PHP
Sophos reports the sample it examined — the same malware ESET has identified as “PoisonedRefresh” — does not write a traditional file-based webshell to disk. Instead, the second-stage sample hides operational strings with RC4, gains execution early by intercepting __libc_start_main, hooks the Apache Portable Runtime module loader (apr_dso_load), and targets Apache’s PHP module to intercept PHP file operations. That hook lets the implant modify legitimate PHP scripts in memory so a web shell is concealed inside files such as apm_css.php3, full_wt.php3, and webtop_popup_css.php3 while their on-disk copies remain unchanged.
The in-memory webshell accepts specially formatted “magic” requests, decrypts the payload carried inside them, executes the code using PHP’s eval() function, and returns an HTTP 201 response disguised as CSS content (text/css). By keeping the PHP files unchanged on disk, Sophos says the implant significantly reduces the detection surface for file-scanning defenses.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPersistence mechanisms, a local backdoor, and stealth timing
Sophos observed a distinct installer or propagation component that infected the Apache binary on BIG-IP APM systems — specifically the /usr/sbin/httpd executable — and altered SELinux configurations. The installer also achieved persistence across BIG-IP upgrade images, according to Sophos. To avoid destabilizing the service and to blend with normal runtime behavior, the implant delays creating a local backdoor: “When the Apache process begins making routine time calls, the implant spawns and detaches the worker thread responsible for creating the local UNIX socket backdoor,” Sophos explains.
That local backdoor is password protected and can launch an interactive Bash shell without opening a TCP listening port. Because the UNIX socket is not directly exposed to the internet, attackers would need another foothold on the device to access it; Sophos did not identify the component used by operators to connect to the socket.
Signals defenders can look for and immediate investigative steps
- Sophos shared concrete signals associated with the malware: Apache workers reading /proc/self/maps, modifications to libphp memory protections, creation of /run/bigtlog.pipe, or unexpected launches of /bin/bash.
- Defenders are advised to investigate unusual POST requests to the targeted .php3 endpoints and to flag PHP responses that combine an HTTP 201 status with text/css content type.
- Because the payload operates in memory and leaves PHP files on disk unchanged, file-integrity checks alone may miss activity; Sophos highlights process-level and memory-related indicators as higher-priority signals.
What this means for enterprises, technologists, and adversaries
- Enterprises and procurement leaders: the ShadowServer count — 795 exposed endpoints — underlines an immediate inventory and patching imperative for any organization running F5 BIG-IP APM. Sophos’s finding that the installer achieved persistence across BIG-IP upgrade images increases the need to verify post-upgrade integrity rather than assume an upgrade clears compromise.
- Technologists and security teams: prioritize the memory- and process-oriented indicators Sophos listed (changes to libphp protections, /proc/self/maps reads, creation of /run/bigtlog.pipe) and look for the HTTP 201 + text/css response pattern on apm_css.php3, full_wt.php3, and webtop_popup_css.php3 endpoints. Also examine /usr/sbin/httpd for unauthorized modification and check SELinux policy changes.
- Adversaries and threat actors: the implant demonstrates a model combining in-memory webshells with a passworded local UNIX socket backdoor to avoid exposing TCP ports, a technique that requires either successful RCE or an additional foothold to fully operationalize.
The chain described by Sophos and observed by ShadowServer — from a reclassified RCE in CVE-2025-53521 to a fileless, in-memory webshell and a passworded local socket — shows how initial exposure can convert quickly into a persistent, stealthy foothold. The technical signals Sophos published give defenders specific, actionable traces to hunt for; with almost 800 exposed endpoints reported yesterday, the practical task is now triage, detection focused on memory and process artifacts, and verification that persistence mechanisms were not implanted across upgrade images.
