PoisonedRefresh is the F5 Rootkit Your File Scanner Won’t Find
Table of contents
A Linux rootkit is running inside F5 BIG-IP APM devices right now, injecting a PHP web shell directly into server memory while leaving every file on disk completely unchanged.
What is unsettling is that the standard file integrity monitoring finds nothing, and The PHP scripts look clean. The web shell is not there, until it is, every time Apache loads them.
What is PoisonedRefresh?
Sophos published its full technical analysis on September 8, describing a second-stage implant that intercepts Apache’s PHP module loader (apr_dso_load), locates libphp in memory via /proc/self/maps, temporarily changes memory protections, injects a malicious PHP web shell into the in-memory view of three legitimate BIG-IP APM scripts (apm_css.php3, full_wt.php3, and webtop_popup_css.php3), and restores memory protections afterward. The files on disk remain unchanged. The malicious version only exists inside the running Apache process.
The injected web shell accepts specially formatted HTTP requests, decrypts their contents using an RC4 key unique to each sample, executes them via PHP’s eval() function, and returns a response disguised as an HTTP 201 with a text/css content type. The RC4 key design means that even if a defender identifies a compromised device, they cannot interact with the web shell without the specific key embedded in that sample, what researchers described as an almost NOBUS (Nobody But Us) design. GBHackers confirmed that PoisonedRefresh also provides a second access path through a UNIX domain socket at /run/bigtlog.pipe, which provides an interactive Bash shell without opening a TCP listener that would show up in network scans.
The implant also gains control before Apache reaches its normal main() function by intercepting __libc_start_main, and it achieves persistence across BIG-IP upgrade images by modifying SELinux configurations and infecting the Apache /usr/sbin/httpd executable at install time.
Which devices are affected?
PoisonedRefresh is assessed as a second-stage payload deployed after exploitation of CVE-2025-53521, a critical unauthenticated remote code execution vulnerability in F5 BIG-IP APM that affects systems where an access policy is configured on a virtual server. F5 originally disclosed CVE-2025-53521 in October 2025 as a denial-of-service issue. It was reclassified as critical RCE in March 2026 after additional evidence emerged. CISA added it to the Known Exploited Vulnerabilities catalog on March 27, 2026. It carries a CVSS 4.0 base score of 9.3.
Affected BIG-IP APM branches span versions 15.1.0 through 15.1.10, 16.1.0 through 16.1.6, 17.1.0 through 17.1.2, and 17.5.0 through 17.5.1. Fixed releases are 15.1.10.8, 16.1.6.1, 17.1.3, and 17.5.1.3. F5 has confirmed exploitation and links the related activity to a cluster it tracks as c05d5254. No specific threat actor has been publicly attributed. Shadowserver tracked 795 internet-exposed BIG-IP APM endpoints still vulnerable as of September 7.
What did Sophos and ESET find?
Sophos and ESET independently analyzed the same implant. ESET named it PoisonedRefresh and published their initial findings on Mastodon before Sophos released its full technical breakdown. Sophos detects the sample as Linux/Agnt-IC. The analyzed sample carries SHA-256 hash:
Why your file scanner won’t catch it
Because PoisonedRefresh leaves no files on disk, standard file integrity monitoring and filesystem-based web shell hunting will return clean results on a compromised device. Sophos recommends hunting for the following behavioral indicators instead: Apache worker processes reading /proc/self/maps; memory permissions changing from writable and executable back to executable only around libphp; creation of /run/bigtlog.pipe; Apache-related processes launching /bin/bash; and unexpected POST requests to apm_css.php3, full_wt.php3, or webtop_popup_css.php3 returning HTTP 201 with a text/css content type.
What you need to do now
F5’s remediation guidance for CVE-2025-53521 should be the first action for any organization running BIG-IP APM. Patching alone is not sufficient for devices that were exposed before the fix was applied. The persistence mechanism, infection of the Apache binary and modification of SELinux configurations, means that a compromised device requires full forensic investigation and reimaging rather than a patch-and-move-on response. A Metasploit module for CVE-2025-53521 is publicly available, which means that 795 still-exposed endpoints are reachable by any attacker with basic tooling, not just the unattributed sophisticated actor behind the original campaign.
CybelAngel identifies internet-exposed F5 BIG-IP management interfaces in clients’ external attack surface inventories. If your organization runs BIG-IP APM and has not confirmed whether the management interface is reachable from the public internet, that question has a concrete answer that does not require waiting for an incident.
About the author
