Exploitation of a Vulnerability in F5 BIG-IP APM Environments: PoisonedRefresh Malware
A recent cybersecurity incident has revealed a sophisticated Linux implant linked to compromised environments of F5 BIG-IP Access Policy Management (APM). At the heart of this attack is the exploitation of a critical vulnerability identified as CVE-2025-53521, which allows unauthenticated remote code execution particularly when access policies are configured on a virtual server.
F5 Networks has confirmed the existence of this vulnerability and has linked the associated malicious activity to an ongoing campaign known as c05d5254. Such campaigns are often characterized by a variety of tactics aimed at undermining the security of web services, and this instance is no exception.
Traditionally, web shells employed by attackers are small scripts written in PHP, JSP, or ASP, placed in accessible directories on web servers. This methodology provides defenders with physical artifacts to track and combat malicious activity. These artifacts can include modified files, unexpected scripts, suspicious POST parameters, and altered file hashes, allowing a more straightforward approach to threat hunting.
However, the malware identified as PoisonedRefresh alters this conventional paradigm. Unlike typical web shells, which leave evident traces, PoisonedRefresh manages to intercept file and memory operations within Apache’s PHP module, known as libphp. It cleverly injects a malicious PHP payload directly into the in-memory view of specific scripts during mmap() operations. This approach means that while the original files remain unchanged and appear harmless on disk, the Apache worker processes execute a corrupted version in memory.
Security firm Sophos has observed this malware particularly targeting key BIG-IP APM webtop files such as apm_css.php3, full_wt.php3, and webtop_popup_css.php3. The injected payload behaves remarkably stealthily. It reads raw data from the input stream (php://input), validates it with a designated request prefix, decrypts the ensuing content, and executes it using PHP’s eval function. In a further effort to blend in with legitimate traffic, it responds to requests with an HTTP 201 status alongside a Content-Type: text/css; charset=utf-8, making malicious command traffic appear as routine CSS-related requests.
The binary of the malware is notably stripped and statically linked, with operational strings encrypted using the RC4 cipher. Instead of the standard Linux process startup sequence, PoisonedRefresh employs a custom Executable and Linkable Format (ELF) loader. This process entails reopening itself through /proc/self/exe, mapping an embedded original executable into memory, and redirecting execution through a wrapper around the __libc_start_main function. This strategy grants the malware control before the host application reaches its normal main() function.
SophosLabs, in a report shared with GBHackers, detailed how the malware modifies Apache/PHP processes into covert backdoors by injecting a PHP web shell directly into memory, all while leaving the legitimate PHP files unaltered on disk. By initiating at an early execution point, the malware can resolve Application Programming Interfaces (APIs), decrypt strings, review process memory, and install hooks before Apache begins managing incoming requests.
Once launched, the implant hooks into the Apache Portable Runtime functions, particularly apr_dso_load, waiting for Apache to load the libphp module. Subsequently, it identifies the PHP module through /proc/self/maps, alters memory protections to permit modifications, and subsequently restores those protections after adjusting execution pathways. This crafty maneuver allows the malware to monitor critical APIs like open, close, mmap, and __fxstat, thereby controlling how the implicated PHP files are interacted with on a semantic level.
Interestingly, PoisonedRefresh also establishes an alternative access route through a UNIX domain socket located at /run/bigtlog.pipe. This aspect of the implant avoids the conventional TCP listener, which could easily be detected through standard network scans. Instead, the malware remains dormant, awaiting activity in the hooked apr_time_now function. Upon detecting such activity, a background worker is initiated, and the local socket is established. After completing authentication processes, the implant routes standard input, output, and error streams through the local socket before executing /bin/bash, thereby creating an interactive local shell. This dual-access setup allows attackers to execute commands driven by HTTP requests while simultaneously maintaining local interactive access through forked child processes.
From an operational perspective, Sophos identifies this implant as Linux/Agnt-IC, with one analyzed sample bearing the SHA-256 hash 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9.
Organizations utilizing the F5 BIG-IP APM platform are urged to prioritize remedial measures by following the guidance provided by F5 regarding the CVE-2025-53521 vulnerability, instead of solely depending on generalized Apache hardening techniques. The vulnerability has a wide impact on multiple versions of BIG-IP APM, including the 15.1.x, 16.1.x, 17.1.x, and 17.5.x branches, with patched versions available in releases such as 15.1.10.8, 16.1.6.1, 17.1.3, and 17.5.1.3.
Cybersecurity defenders need to be vigilant in correlating various signals indicative of compromise. Signs to monitor include Apache workers accessing /proc/self/maps, changes in memory permissions around libphp, the creation of /run/bigtlog.pipe, and unexpected HTTP POST traffic directed to affected .php3 files returning HTTP 201 responses with CSS content types.
This incident underscores the limitation of traditional disk-centric hunting for web shells; in the case of PoisonedRefresh, filesystem inspections might reveal clean PHP scripts, while a deeper examination of memory, process behavior, and HTTP telemetry could expose the presence of an active backdoor.