Sophisticated Linux Implant Targets BIG-IP APM Environments via Advanced Runtime Memory Manipulation

SophosLabs recently identified a highly sophisticated Linux-based malware implant specifically engineered to compromise F5 BIG-IP Access Policy Management (APM) environments. This malicious campaign, which security researchers have identified as "PoisonedRefresh," leverages advanced tradecraft, including custom ELF loading, function hooking, and runtime code patching, to establish persistent, stealthy access to enterprise infrastructure. Unlike traditional web shells that reside as static scripts on a server’s disk, this implant manipulates the Apache and PHP runtime environments to execute malicious code entirely in memory, effectively bypassing standard file-integrity monitoring tools and traditional signature-based detection.

The Anatomy of the PoisonedRefresh Campaign

The discovery began when analysts identified a second-stage payload associated with compromised BIG-IP APM systems. Further investigation revealed a multi-stage architecture. A distinct installer component, often disguised as a system utility named "umount," is responsible for the initial infection. This installer targets the /usr/sbin/httpd binary, modifying SELinux configurations and ensuring the malicious payload persists across BIG-IP upgrade images. By monitoring upgrade workflows in directories like /mnt/tm_install, the threat actor ensures that the implant survives system maintenance and reboots.

The technical sophistication of this malware lies in its "bring your own loader" approach. Upon execution, the implant bypasses the standard Linux dynamic linker process. Instead, it manually maps its own embedded ELF into memory, hooks into the __libc_start_main function, and ensures its initialization code runs before the host application’s primary logic. This early execution window allows the malware to remain dormant until it identifies that the Apache server has loaded the PHP module (libphp).

Once active, the implant hooks the Apache Portable Runtime (APR) function apr_dso_load. By monitoring this specific API, the malware can surgically inject its malicious logic only when the targeted environment—a BIG-IP APM webtop—is ready. It then uses the /proc/self/maps interface to locate libphp in memory, where it performs relocation patching to intercept critical system calls such as open, mmap, and __fxstat.

Memory-Only Web Shell Delivery

The most innovative aspect of this implant is its method of delivering a web shell. Rather than planting a file in the web root, the malware intercepts read requests to specific, legitimate PHP files utilized by the BIG-IP APM interface. When the server attempts to access these files, the malware provides a modified, in-memory representation that includes the malicious web shell payload. Consequently, the disk version of the file remains pristine and benign, while the executing process is running compromised code.

This technique renders traditional forensic investigations—which typically rely on hashing files or scanning directories for suspicious scripts—largely ineffective. Because the malicious content never touches the disk in its final form, security tools that lack deep memory inspection capabilities will likely fail to detect the presence of the web shell.

In addition to this web-based access, the implant establishes a local UNIX domain socket at /run/bigtlog.pipe. This allows the attacker to spawn an interactive /bin/bash session without opening a traditional TCP listening port, thereby avoiding detection by network-based intrusion detection systems (NIDS) that monitor for unexpected listening sockets.

Contextual Background and Vulnerability Association

F5 Networks has officially associated this activity with the exploitation of CVE-2025-53521, a critical unauthenticated remote code execution (RCE) vulnerability in BIG-IP APM systems. The vulnerability exists when an access policy is configured on a virtual server, allowing unauthenticated attackers to trigger the initial infection chain.

The security community became aware of the campaign’s breadth when researchers from ESET independently analyzed the malware and confirmed the "PoisonedRefresh" moniker. The convergence of ESET’s and SophosLabs’ findings underscores the severity of the threat. While attribution remains elusive, the level of engineering required to hook core Linux runtime components, manipulate memory mappings, and survive complex firmware upgrade workflows suggests an actor with significant resources and deep expertise in Linux systems architecture.

Timeline of Discovery and Remediation

• Initial Detection: Security researchers identified abnormal behavior in BIG-IP APM systems, characterized by unauthorized modifications to the httpd process.
• Malware Identification: Analysis of the "umount" installer and the corresponding second-stage payload revealed the use of RC4-encrypted strings and custom ELF loading.
• Vulnerability Link: F5 released guidance linking the activity to CVE-2025-53521, urging administrators to apply security patches immediately.
• Independent Verification: ESET researchers confirmed the methodology, noting the implant’s ability to evade detection via runtime memory manipulation.
• Current Status: Defenders are now shifting toward behavioral-based detection strategies, emphasizing the importance of monitoring memory protection changes and unusual process startup sequences.

Implications for Enterprise Security

The emergence of PoisonedRefresh represents a significant evolution in Linux-based cyber threats. As enterprises migrate to more complex, cloud-native, and containerized infrastructures, the reliance on traditional file-centric security models is becoming a critical weakness. This campaign demonstrates that attackers are increasingly moving "below" the application layer to manipulate the operating system and runtime environment directly.

For organizations relying on BIG-IP APM for critical network traffic management, the implications are profound. The ability for an attacker to persist across firmware upgrades and remain invisible to file integrity checkers necessitates a defense-in-depth strategy. IT security teams must now prioritize:

1. Memory Analysis: Deploying endpoint detection and response (EDR) solutions that can monitor for unauthorized mprotect() calls and modifications to executable memory regions.
2. Process Monitoring: Investigating early-process lifecycle behavior, particularly any modifications to the _start or __libc_start_main routines.
3. Behavioral Baselines: Establishing strict baselines for Apache/PHP processes, flagging any anomalous access to /proc/self/maps or unexpected interaction with UNIX domain sockets.
4. Patch Management: Given the exploit path through CVE-2025-53521, rigorous adherence to F5’s security bulletins is the primary defense against the initial ingress.

Official Guidance and Expert Commentary

In response to the threat, F5 has emphasized that remediation must go beyond standard hardening. Administrators should perform a comprehensive compromise assessment to ensure that the "umount" installer or other persistence mechanisms have not already been deployed. Simple updates to Apache or PHP configurations, while recommended for general security hygiene, are insufficient if the underlying runtime environment has been hooked by the implant.

Security analysts emphasize that this case serves as a "wake-up call" for the industry. "When defenders hear ‘web shell,’ they traditionally think of a script on a disk," says one security researcher familiar with the analysis. "This implant forces us to realize that the ‘file’ is becoming an abstraction. If the attacker controls the runtime, they can lie to the system about what is on the disk. Defenders must stop looking at what the file is and start looking at what the process does."

Conclusion: The Future of Linux Defense

The PoisonedRefresh implant is a hallmark of the next generation of Linux malware. By moving away from file-based artifacts and into the realm of memory-resident hooks and runtime redirection, threat actors are challenging the efficacy of modern security operations centers.

The success of this campaign in evading detection highlights the necessity of integrated, multi-layered security. Defenders can no longer rely on singular tools to provide visibility into their environments. Instead, they must correlate evidence from filesystem logs, network traffic, process telemetry, and memory state. As the landscape of cyber warfare continues to shift toward such stealthy, sophisticated payloads, the ability to rapidly detect and respond to behavioral anomalies—rather than just known file signatures—will be the defining factor in protecting enterprise infrastructure against the next generation of advanced persistent threats. Organizations are urged to audit their BIG-IP configurations immediately and review all recent system logs for evidence of the indicators identified by Sophos and ESET.