Linux Rootkit Injects Fileless PHP Web Shells on F5 BIG-IP Servers

Key Takeaways

• A sophisticated Linux rootkit is exploiting F5 BIG-IP Access Policy Manager (APM) servers.
• The malware deploys fileless PHP web shells directly into memory, making it difficult to detect with traditional file-based scans.
• The activity is linked to a previously identified, unauthenticated remote code execution vulnerability, CVE-2025-53521, affecting BIG-IP APM webtop environments running Apache and PHP.
• The rootkit establishes persistent access through a multi-stage infection process, including a local Unix socket backdoor that bypasses network monitoring.
• Organizations must implement comprehensive detection and remediation strategies, focusing on memory forensics, network traffic analysis, and F5’s specific patch guidance.

A new, highly evasive Linux rootkit is enabling threat actors to maintain persistent control over compromised F5 BIG-IP Access Policy Manager (APM) servers. This advanced malware circumvents conventional detection methods by injecting fileless PHP web shells directly into the server’s operational memory rather than leaving detectable malicious files on disk.

This malicious activity has been linked by F5 to CVE-2025-53521, a critical, unauthenticated remote code execution (RCE) vulnerability. This flaw specifically targets BIG-IP APM webtop environments that utilize Apache and PHP, a weakness previously highlighted in warnings regarding vulnerable BIG-IP APM deployments.

Security researchers at Sophos said in a report that their analysts discovered this implant during an investigation into compromised systems. They noted that the rootkit’s design suggests a highly targeted, second-stage payload, rather than a generalized attack against typical web server installations. At the time of their analysis, there was insufficient evidence to attribute the activity to a specific threat actor.

The implications for organizations are severe. Traditional endpoint security solutions that rely on file system integrity checks may fail to detect this intrusion, as the malicious PHP web shell exists solely in the dynamic memory space of the running Apache process. For businesses leveraging BIG-IP APM for remote access, this stealthy foothold provides attackers with persistent server-side control and a covert pathway into otherwise protected internal infrastructure.

Linux Rootkit Injects Fileless PHP Web Shells

The rootkit’s operational sophistication begins even before the legitimate host program initiates its primary functions. It first loads its own image, then manually loads the original executable, and crucially, intercepts a fundamental Linux startup routine. This early intervention provides the rootkit with a critical advantage, allowing it to establish hooks and modify system behavior before standard Apache processes commence, thereby undermining the effectiveness of conventional startup monitoring tools.

Following this initial compromise, the rootkit monitors Apache’s module loader, activating specifically when the PHP component, libphp, is detected. The implant then modifies how specific file and memory operations within libphp are handled. This targeted approach enables it to control how certain scripts are opened and mapped into memory, contributing significantly to its ability to remain concealed within what appears to be a legitimate web service.

The primary targets for this in-memory web shell injection are three specific APM webtop scripts. When PHP attempts to map one of these scripts into memory, the rootkit intervenes, creating a modified copy that combines the original script’s content with its own malicious web shell. Critically, the original file on the disk remains unaltered. This technique means that security scans focused solely on the web root files will likely miss the compromise, a stark contrast to patterns observed in earlier BIG-IP RCE attacks. The injected code responds to specially crafted requests, decrypting their content, and executing arbitrary commands on the server.

To further obscure its operations, the web shell returns an HTTP 201 response, but masquerades as a CSS resource. This unusual combination of status code and content type can allow it to blend into legitimate asset traffic, making its detection more challenging. Consequently, a thorough investigation requires examining web logs, response headers, and request patterns in addition to traditional filesystem integrity checks.

Socket Backdoor Raises Response Stakes

Beyond the fileless web shell, the rootkit establishes a local Unix socket, which can be used to grant an authenticated connection to a Bash shell. This particular backdoor mechanism does not open a standard TCP listening port, meaning that network-only monitoring solutions may fail to detect its presence. This finding provides crucial context to <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/7bc3cbb3-68c8-4815/Linux-Rootkit-Injects-Fileless-PHP-Web-Shells-Into-Compromised-F5-BIG-IP-Servers.pdf?AWSAccessKeyId=ASIA2F3EMEYEYDEV7RYG&Signature=9zalizOBya%2F6KXce1fNBbZ6WGhU%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEHcaCXVzLWVhc3QtMSJHMEUCIQCIGyko0vbDW2tNsK6GZjIQse2u27Nv7HYQktwW29PkSwIgcKPWfEESYJBtv0tKX9nphSu8P1pRbZ0Dd2aGGnPKvwwq8wQIPxABGgw2OTk3NTMzMDk3MDUiDLz7YCNxQoD%2F%2BtFctCrQBI%2BmEUP4I3e097XNjvrrHEOx2dkgfxxK%2FFf6QPg61zGqwrJCPQ5KGk8xc1W2sftAi05C6EzPFuZ7TJokFKjbxA%2FECBrp4Aq6el7Jvbz5DYkK6D%2FYmheXuv1AMuy9KQETGBXOGAgseV%2B2WSPE7GkZ2UvZptvzFP3qANVuHTSeRyoLzKQsLj0G%2BgLcysyCHReAioREgJxUUfmDRV3MRww6gnHu9oZbLHjK6aFkK6yTnzfRRbAg9KjzOm5t7N5B8vMsjAunLluMSW8bReLLt8vh3J5zGlJgbwslr7IP6wBu37QWiCWatwlEie65Q3whVlbqx64JFlOcrbj%2BJLMY5n5fROv0xqBR1jyBP6AMVYcX1V7pJHX5GW6VRnteZ6eLCwpBn83aGM%2BadzlOeSQ8f%2FlW7

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.