Security researchers have uncovered a sophisticated Linux rootkit, dubbed 'PoisonedRefresh', that infiltrates F5 BIG-IP APM devices to inject fileless web shells directly into memory. The attack leverages a critical RCE flaw to maintain stealthy persistence and bypass traditional disk-based detection.

  • Sophisticated rootkit targets F5 BIG-IP APM environments using a fileless injection method.
  • Exploits critical vulnerability CVE-2025-53521 to gain initial remote code execution.
  • Injects malicious PHP web shells into memory, leaving on-disk files untouched to evade detection.
  • Achieves persistence by modifying SELinux configurations and infecting the Apache executable.

Cybersecurity firms Sophos and ESET have sounded the alarm over a highly advanced Linux rootkit targeting F5 BIG-IP Access Policy Manager (APM) devices. The malware, identified by ESET as 'PoisonedRefresh', represents a significant escalation in attack tradecraft, moving away from traditional file-based malware to a memory-resident approach that is exceptionally difficult to detect.

The attack chain likely begins with the exploitation of CVE-2025-53521, a critical remote code execution (RCE) vulnerability. While F5 Networks initially classified this as a Denial of Service (DoS) issue in March, it has since been reclassified as a severe RCE flaw, providing the gateway for hackers to deploy this second-stage payload.

Read Also:Delhi Police Issues Takedown Notices on Protest‑Related Content

Technically, the rootkit operates by intercepting the Apache /usr/sbin/httpd executable. Instead of writing malicious scripts to the hard drive, it hooks the Apache Portable Runtime (APR) module loader. This allows the attackers to inject a PHP web shell directly into the memory space of legitimate scripts, such as apm_css.php3. Because the files on the disk remain pristine, standard file-integrity monitors are bypassed entirely.

Why This Matters

BozokMedia analysis shows that this attack marks a shift toward 'invisible' persistence. By manipulating the __libc_start_main function and utilizing RC4 encryption for its operational strings, the rootkit hides in plain sight. The use of a local UNIX socket for Bash shell access—rather than an open TCP port—means that traditional network scanners will find no open 'backdoors,' making the compromise nearly invisible to standard perimeter security.

"The ability to inject code directly into the memory of a running process while leaving the disk untouched is the gold standard for stealth in modern cyber-espionage."

Furthermore, the malware demonstrates high operational maturity by delaying the creation of its backdoor until the Apache process has stabilized. This prevents service crashes that would typically alert system administrators to an anomaly. It also modifies SELinux configurations to ensure that the malware survives system upgrades, ensuring long-term access to the target network.

The ShadowServer Foundation has reported that hundreds of endpoints remain exposed to the underlying CVE, leaving a wide window of opportunity for threat actors. Defenders are urged to monitor for unusual HTTP 201 responses disguised as CSS content and suspicious reads of /proc/self/maps by Apache workers.

Did You Know?: Fileless malware resides entirely in RAM, meaning a simple reboot can sometimes wipe the infection, though this specific rootkit achieves persistence through the Apache executable.

Frequently Asked Questions

Q1: How does the 'PoisonedRefresh' rootkit evade detection?
It uses memory injection to place web shells in PHP scripts without changing the files on the disk, and it uses a local UNIX socket instead of a network port for communication.

Q2: Which vulnerability is primarily exploited for this attack?
The attack leverages CVE-2025-53521, a critical remote code execution flaw in F5 BIG-IP systems.