Sophos Details Memory-Only Web Shell on F5 BIG-IP APM

Memory-resident web shell found in BIG-IP APM activity

Sophos has analysed malware associated with intrusions targeting F5 BIG-IP Access Policy Manager appliances that inserts a PHP web shell into memory rather than leaving its final form on disk. The technique means conventional file scans can report clean copies of the affected scripts even while Apache serves attacker-controlled code.

The activity is linked by F5 to CVE-2025-53521, an unauthenticated remote-code-execution vulnerability affecting BIG-IP APM when an access policy is configured on a virtual server. F5 rates the flaw at 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. It was initially published as a denial-of-service issue in October 2025, then reclassified as exploited remote code execution on March 27, 2026.

The vulnerable release ranges are BIG-IP 17.5.0 through 17.5.1, 17.1.0 through 17.1.2, 16.1.0 through 16.1.6, and 15.1.0 through 15.1.10. Fixed versions are 17.5.1.3, 17.1.3, 16.1.6.1 and 15.1.10.8 respectively. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on the day F5 disclosed exploitation.

How the implant avoids disk-based detection

Sophos examined one sample and found an installer named umount that modifies /usr/sbin/httpd, placing malicious code before the genuine Apache program. Related samples analysed by ESET as PoisonedRefresh were designed to run with root privileges, disable SELinux and alter files in BIG-IP installation images.

Because the malicious code executes before Apache’s own startup logic, it can hook the Apache Portable Runtime function apr_dso_load. When Apache loads the PHP module, libphp, the implant reads /proc/self/maps, locates the module in memory and temporarily changes page permissions. It then changes the functions PHP uses to open, size and map files before restoring the original protections.

The altered view applies to three APM webtop scripts: apm_css.php3, full_wt.php3 and webtop_popup_css.php3. When one is mapped, the malware prepends its web shell to the in-memory content. This accounts for F5’s warning that changes to those scripts alone do not establish compromise: the files do not need to be modified at all.

Signals defenders should investigate

The web shell processes the raw request body, checks for a marker, decrypts the remaining content and executes it. Its replies use HTTP status 201 and a CSS content type, making command exchanges resemble stylesheet requests. The sample also creates /run/bigtlog.pipe, checks for a fixed token and connects the local socket to /bin/bash. Sophos found no code showing how that socket is reached.

Useful investigation leads include unexpected /run/bigtlog.pipe or /run/bigstart.ltm files; mismatches in the hash, size or timestamp of /usr/bin/umount or /usr/sbin/httpd; and failures in F5’s sys-eicheck integrity tool. Analysts can also review logs for local access to the iControl REST API, SELinux being disabled, and commands launched through iControl REST.

Network and host telemetry can add further evidence. Sophos highlights HTTP 201 responses with CSS content types, Apache workers reading /proc/self/maps, memory-permission changes around libphp, sockets bound under /run, and unexpected /bin/bash processes. These signals are leads rather than standalone proof and should be assessed with file, process and memory evidence.

Patching does not replace compromise assessment

F5’s patch remains valid against exploitation, but patching does not determine whether an appliance was compromised before the update. The UK National Cyber Security Centre advises investigating for compromise regardless of when a system was updated, while Ireland’s National Cyber Security Centre recommends collecting a qkview report, sending it to F5 and opening a support case.

For organisations operating BIG-IP APM, the practical implication is to pair remediation with an integrity and incident-response review: run sys-eicheck, preserve relevant logs, examine memory against disk copies, and involve F5 where indicators appear. Where a full investigation is not possible, the UK NCSC advises isolating the appliance and rebuilding it as new, recognising that this may cause an outage.