Malware linked to recent breaches of **F5 BIG-IP Access Policy Manager** appliances is employing a novel technique to evade detection, according to an analysis published by **Sophos** on September 7. Instead of dropping a PHP web shell onto the disk, the malware injects it directly into memory when **Apache** loads specific PHP scripts. This means that a scan of the files on disk will return clean, making traditional detection methods ineffective. ### The Evolving Threat of Web Shells Typically, a web shell is a small script planted in a web server's directories, allowing attackers to execute commands via ordinary web requests. These are usually detected by scanning files and comparing them against known-good copies. However, this new approach by the malware, which **F5** tracks as **c05d5254**, circumvents such defenses. As **Sophos** researchers highlight, the web shell "does not need to exist in its final form on disk." ### Targeted PHP Scripts and Vulnerability Link The three specific PHP scripts targeted are `apm_css.php3`, `full_wt.php3`, and `webtop_popup_css.php3`, all part of the **BIG-IP APM** webtop. **F5** had previously listed these in March as indicators of compromise, noting that their modification alone might not signify a breach. The **Sophos** analysis now explains why this is the case. **F5** has linked the **c05d5254** activity to appliances affected by **CVE-2025-53521**. Initially classified as a denial-of-service vulnerability in October 2025, **F5** reclassified it as a critical remote code execution (RCE) flaw on March 27, 2026, after observing active exploitation. The vulnerability, which requires no authentication, carries a CVSS 3.1 score of 9.8 and CVSS 4.0 score of 9.3. On the same day, **CISA** added **CVE-2025-53521** to its Known Exploited Vulnerabilities catalog, urging U.S. federal civilian agencies to patch by March 30. The flaw affects **BIG-IP APM** access policies configured on a virtual server, a common component in many large organizations, as noted by the **UK National Cyber Security Center** (**NCSC**). ### Affected Versions and Patches | Versions known to be vulnerable | Fixed in | | :------------------------------ | :------- | | 17.5.0 - 17.5.1 | 17.5.1.3 | | 17.1.0 - 17.1.2 | 17.1.3 | | 16.1.0 - 16.1.6 | 16.1.6.1 | | 15.1.0 - 15.1.10 | 15.1.10.8 | Despite the patch being available for nearly a year, exploitation continues. Ireland's **National Cyber Security Center** (**NCSC**) confirmed in a March 31 advisory that the October patch remains effective against exploitation. ### The Infection Chain The in-memory web shell is the final stage of a more extensive infection chain. **Sophos** identified a separate installer, dubbed `umount`, which infects the **Apache** web server program at `/usr/sbin/httpd` by prepending malicious code to the legitimate file. This strongly suggests the installer directly injects the payload. **ESET**, which analyzed related samples in April and named the malware **PoisonedRefresh**, noted that the installer is designed to run as root, disable **SELinux**, and infect `umount`, `httpd`, and `rc.local` within **BIG-IP** install images. This suggests an intent to propagate the malware through installation media. ### How the In-Memory Web Shell Operates The malware, residing within the **Apache** program, executes before **Apache**'s own code. It hooks the **Apache Portable Runtime** function `apr_dso_load`, remaining dormant until the **PHP** module, `libphp`, is loaded. Once `libphp` is in memory, the malware reads `/proc/self/maps` to locate the module, temporarily makes those memory pages writable, and then rewrites the file operations (**open**, **size**, **map**) used by the module. It then restores the original permissions. This allows the malware to control what **PHP** sees when it accesses the three targeted scripts, injecting the web shell content before the original file's content when mapped into memory. The web shell processes raw request bodies, checks for a specific marker, decrypts the remaining data, and executes it. It replies with an **HTTP 201** status and a **CSS** content type, making the interaction appear as a benign stylesheet request. Additionally, the malware establishes a local socket at `/run/bigtlog.pipe`. After verifying a fixed token, it connects this socket to `/bin/bash`, providing an interactive shell without opening a network port. **Sophos** could not confirm if the attacker accesses this socket via the web shell, as no connecting code was found in the analyzed sample. ### What Defenders Can Check **Sophos** emphasizes that behavioral signals should be investigated alongside file, process, and memory evidence. The following indicators combine **Sophos**' findings with **F5**'s previously published indicators: * **File**: Presence of `/run/bigtlog.pipe` or `/run/bigstart.ltm`. * **Binary**: Hash, size, or timestamp mismatch on `/usr/bin/umount` or `/usr/sbin/httpd` compared to a known good copy. (Note: **F5** advises that sizes and timestamps can vary between releases and hotfixes). * **Tool**: **sys-eicheck** failing due to changes in `/usr/bin/umount` or `/usr/sbin/httpd`. * **Log**: An entry in `/var/log/restjavad-audit` showing a local user accessing the **iControl REST API** from localhost. * **Log**: An entry in `/var/log/auditd` showing **SELinux** being disabled via the same route. * **Log**: An entry in `/var/log/audit` showing a `bash` command executed through **iControl REST**. **F5** notes these lines may show base64 data written to a file and `/run/bigstart.ltm` being run. * **Traffic**: **HTTP 201** responses with a **CSS** content type originating from the appliance. * **Host behavior**: An **Apache** worker reading `/proc/self/maps`, altering memory permissions around `libphp`, binding a socket under `/run`, or initiating `/bin/bash`. * **SHA-256**: `26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9`. * **File (weak indicator)**: Changes to the three `.php3` scripts. **F5** states their presence alone doesn't indicate a problem, and the **Sophos** analysis explains why the file itself might not change. **F5**'s list also includes indicators not covered by the **Sophos** analysis, such as `/run/bigstart.ltm` and changes affecting **sys-eicheck**. Neither account provides a complete picture of the intrusion. ### Post-Patching Considerations Applying the patch does not guarantee an appliance was not compromised *before* the patch was installed. Ireland's **NCSC** anticipates that some exploitation likely occurred prior to the initial vulnerability disclosure and fix in October 2025. The **UK NCSC** advises investigating for compromise "regardless of when the system was updated." 1. **Run F5's `sys-eicheck` integrity check**: A failure of this tool is a strong indicator of compromise, as the malware modifies `/usr/bin/umount` and `/usr/sbin/httpd`. 2. **Collect and submit a `qkview` report to F5**: Ireland's **NCSC** recommends this, noting that **F5** can analyze the report for signs of compromise, and filing a case will expedite a comprehensive response. 3. **Compare in-memory module contents against disk copies**: **Sophos** suggests incorporating this into incident response playbooks for critical web servers. 4. **Isolate and rebuild (if full investigation is not possible)**: The **UK NCSC** advises isolating and rebuilding the appliance from scratch, acknowledging this may cause an outage. Several unknowns remain: **F5** has not disclosed when exploitation began. Furthermore, neither **Sophos** nor **ESET**'s analyses, nor any official advisories, clarify whether upgrading an appliance to a fixed release removes already installed malware, especially given that the malware's components are designed to persist through upgrade images. Finally, no specific attacker has been publicly identified.